CVE-2026-15689 is a critical vulnerability in ABEVERLEY's Dancer2::Plugin::Auth::Extensible (Perl) affecting versions up to 0.713. The issue arises because the password reset and welcome emails generate reset links using the HTTP Host or X-Forwarded-Host header without proper validation. An unauthenticated POST request to /login with submit_reset and a username triggers generation of a reset code and sends an email containing a link with an attacker-controlled host. This allows an attacker to craft reset links that redirect victims to attacker-controlled domains, where the reset code can be captured and used to hijack accounts. The vulnerability is tracked as CWE-640 (Weak Password Recovery Mechanism).

An attacker can perform password reset link poisoning by supplying a malicious Host or X-Forwarded-Host header, causing victims to receive reset emails with links pointing to attacker-controlled domains. If a victim follows such a link, the attacker obtains a valid password reset code, enabling full account takeover. The vulnerability requires no authentication and affects default configurations, making it highly impactful with a CVSS score of 9.8 (critical).

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, users should avoid using the default reset_password_handler configuration or customize the base URL used in password reset emails to a trusted value rather than relying on the untrusted Host or X-Forwarded-Host headers. Monitoring vendor communications for an official fix is recommended.