The vulnerability in Dancer2::Plugin::Auth::Extensible (<=0.713) involves the construction of password reset and welcome email links using the request Host header or X-Forwarded-Host header when behind a proxy. These headers are untrusted and can be manipulated by an attacker. When a POST request to /login with submit_reset and a username is made, a reset code is generated and emailed with a link containing the attacker-controlled host. If the victim clicks this link, the attacker can use the reset code to take over the account. Versions through 0.711 use request->uri_base and request->base directly; versions 0.712 and later introduce an uri_base configuration key that defaults to the untrusted request->uri_base if unset, maintaining the vulnerability unless properly configured.

An unauthenticated attacker can poison password reset links sent to users by manipulating the Host or X-Forwarded-Host headers. This allows the attacker to craft reset links pointing to a host they control. If a victim clicks such a link, the attacker gains access to a valid reset code, enabling account takeover. The vulnerability affects confidentiality, integrity, and availability of user accounts, with a CVSS score of 9.8 indicating critical severity.

No official patch or remediation level is currently documented. Users should avoid relying on the default configuration that uses untrusted headers for constructing reset links. It is recommended to explicitly configure the uri_base parameter to a trusted, fixed value rather than relying on request headers. Monitor vendor advisories for official fixes or updates. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance.