Executive brief
Dancer2::Plugin::Auth::Extensible is a Perl library that handles user authentication and account management for web applications. A flaw in password reset and welcome emails allows attackers to redirect users to malicious sites by controlling the Host header in login requests, enabling account takeover when victims click poisoned reset links. An attacker can reset any user's password without authentication and trick the victim into visiting the attacker's server to complete the takeover.
Technical details
This is a host header injection vulnerability in the password reset email generation logic (functions _default_email_password_reset and _default_welcome_send). The vulnerability exists because these functions construct password reset links using the untrusted request Host header or X-Forwarded-Host header (via Dancer2's request->base function), rather than a trusted configuration value. An unauthenticated attacker can POST to /login with submit_reset and a target username to generate a reset code and trigger an email containing a link pointing to the attacker's host. When the victim clicks the link, they surrender the reset code to the attacker's server, allowing account takeover. Versions through 0.711 read request->uri_base directly; versions 0.712+ provide an uri_base configuration key that defaults to the same untrusted value when unset. The fix requires administrators to explicitly configure a trusted uri_base value or upgrade to a patched version that defaults securely.
Affected products
- Dancer2 community Dancer2::Plugin::Auth::Extensible through 0.713
Timeline
- 2026-08-15: disclosed