THREATOPS

THREAT OPS › Threat News › CVE-2026-15689: Dancer2::Plugin::Auth::Extensible versions through 0.713 for Perl allow password reset link poisoning via the request Host header in _default_email_password_reset and _default_welcome_send

CVE-2026-15689: Dancer2::Plugin::Auth::Extensible versions through 0.713 for Perl allow password reset link poisoning via the request Host header in _default_email_password_reset and _default_welcome_send

medoss_secPublished 2026-08-15

Posted by Timothy Legge on Aug 15======================================================================== CVE-2026-15689 CPAN Security Group ======================================================================== CVE ID: CVE-2026-15689 Distribution: Dancer2-Plugin-Auth-Extensible Versions: thro

Indicators of compromise

CVE-2026-15689cve
https://metacpan.org/dist/Dancer2-Plugin-Auth-Extensibleurl

Original source: https://seclists.org/oss-sec/2026/q3/503

Same event, other sources

[NVD] CVE-2026-15689 — Dancer2::Plugin::Auth::Extensible versions through 0.713 for Perl allow password reset link poisoning via the request Host header in _default_email_password_reset and _default_welcome_send. Both default emails emit a link of the form `$base/login/$code`, whose authority comes frnvd · 2026-08-15