Perl Dancer2 Authentication Plugin Flaw Lets Attackers Redirect Password Reset Emails on openSUSE Leap
openSUSE has published advisory openSUSE-SU-2026:22190-1, which the project rates as critical, covering a single vulnerability and one bug fix in the perl-Dancer2-Plugin-Auth-Extensible package on openSUSE Leap 16.0. The flaw is tracked as CVE-2026-15689 and recorded internally as bsc#1275272. The affected component is an authentication plugin for Dancer2 Perl web applications, providing login handling along with password reset and welcome email workflows. The fixed package is perl-Dancer2-Plugin-Auth-Extensible-0.714.0-bp160.1.1, which rolls up upstream releases 0.713 and 0.714.
The upstream release notes describe the mechanism directly. When generating password reset and welcome emails, the plugin derived the link hostname from the incoming request rather than from a trusted, fixed value. If the application does not otherwise enforce a particular hostname, an attacker can trigger these emails for genuine users and cause them to contain links pointing at a malicious host. Release 0.713 addresses this by adding a new uri_base parameter so the base URI for generated links can be pinned explicitly, and also repairs a regression from the previous security fix that cached the first base URI and broke applications legitimately serving multiple hosts. Release 0.714 is a test-only change for systems without a sendmail binary.
The practical risk sits with account recovery, one of the most trusted message types a user receives. Because the mail originates from the genuine application, a recipient has few cues that the embedded link leads elsewhere, and a reset token submitted to an attacker-controlled host can translate directly into account takeover. Exposure is limited to Dancer2 deployments that do not already constrain the request hostname at the web server or framework layer. FIRST EPSS places the probability of exploitation in the next 30 days at 0.8 percent, and no exploitation of CVE-2026-15689 has been reported.
Attack Surface
Web Application, Email
Tactics
Initial Access, Credential Access, Reconnaissance
Techniques
- T1566.002 – Phishing: Spearphishing Link
- T1598.003 – Phishing for Information: Spearphishing Link
- T1078 – Valid Accounts
SuperPRO's Threat Countermeasures Procedures
- Apply the openSUSE Leap 16.0 patch with 'zypper in -t patch openSUSE-Leap-16.0-packagehub-698=1' so that perl-Dancer2-Plugin-Auth-Extensible is at version 0.714.0-bp160.1.1 or later.
- Set the new uri_base parameter introduced in Dancer2::Plugin::Auth::Extensible 0.713 to the canonical HTTPS hostname of each application, so password reset and welcome email links are no longer built from the request host.
- Audit hosts for CPAN-installed copies of Dancer2::Plugin::Auth::Extensible that sit outside RPM management (perl -MDancer2::Plugin::Auth::Extensible -e 'print $Dancer2::Plugin::Auth::Extensible::VERSION') and upgrade any instance below 0.713.
- Enforce an allow-list of hostnames at the web tier in front of the Dancer2 application: define an explicit nginx server_name or Apache ServerName/ServerAlias set and have the default virtual host reject unmatched Host headers rather than passing them through.
- Add a proxy or WAF rule that drops requests whose Host, X-Forwarded-Host or X-Host headers do not match the approved domain list, and log the rejected values for review.
- Review outbound mail logs and queued messages from affected Dancer2 applications for password reset or welcome emails containing links whose hostname differs from the organisation's canonical domain.
- Invalidate outstanding password reset tokens issued by affected applications before the upgrade and check authentication logs for reset requests that were initiated but never completed by the account owner.
