External risk intelligence

Dancer2 Auth Extensible Plugin Password Reset Poisoning Vulnerability

CVE advisorySeverity: CRITICAL (CVSS 9.8)

CVE-2026-15689

This vulnerability exists in a web application framework plugin used to handle authentication, password resets, and user registration. Applications utilizing these features are commonly deployed as internet-facing web services that must be reachable by users to function, making the affected interface a common part of an externally accessible web application surface.

Halo Surface Signal: 4 out of 5 — likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

A security vulnerability has been identified in a Perl authentication plugin that could allow an attacker to reset user passwords by manipulating link destinations. This issue affects how the system generates password reset and welcome email links, potentially redirecting users to malicious sites and enabling account takeover. The main concern is confirming if this specific plugin is in use and if these features are enabled.

Attackers can poison password reset links.
Account takeover risk via malicious links.
Confirm use and feature enablement.

Attack Path

How an attacker could exploit the issue

An attacker can initiate a password reset or user welcome process to poison a password reset link. This is achieved by sending a crafted request to the login endpoint, which then sends an email containing a malicious link to the target user. If the user clicks this link, the attacker can gain control of their account.

No authentication required.
User clicks crafted reset link.
Account takeover.

Live Threat

Current exploitation, exposure, and threat context

A vulnerability in this Perl authentication plugin could allow an attacker to trick users into sending password reset tokens to a host they control. This could occur when the plugin's default email functions are used to send password reset or welcome messages. When supported, a user clicking a malicious link in such an email could expose their account to takeover.

User account access.
Users clicking malicious links.
Account takeover.

Operational Fix

Recommended remediation, mitigation, and detection steps

This critical vulnerability in Dancer2::Plugin::Auth::Extensible allows for account takeover through password reset link poisoning. Application owners or platform teams responsible for the Perl-based web services utilizing this plugin must first identify all instances of the affected technology, confirm their reachability and business criticality, and then prioritize remediation efforts.

Application owners or platform teams should own the issue.
Verify reachability and business criticality of instances.
Plan remediation based on identified risk.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is Dancer2::Plugin::Auth::Extensible used for?

This is a Perl-based plugin for the Dancer2 web application framework. Developers integrate it into their websites to manage authentication tasks, such as handling user login sessions, processing password reset requests, and facilitating new user registration emails.

What does CWE-640 mean for CVE-2026-15689?

CWE-640 identifies a weakness where an application fails to properly protect a password reset mechanism. In this CVE, the plugin relies on external, untrusted input to generate links sent via email. Because the system trusts the request header to define the link's destination, it can be manipulated to redirect users to an attacker-controlled host instead of the legitimate site.

How do attackers trigger this password reset link poisoning?

An attacker triggers this by sending a crafted HTTP request to the application's login endpoint, specifically targeting password reset or user welcome processes. This does not require prior authentication. Note that simply visiting the site or clicking links is not the trigger; the bug is only invoked when the application server receives a manipulated request that forces the system to generate a fraudulent email link.

Is my application at risk according to Halo Surface Signal?

Halo Surface Signal notes that this plugin manages critical authentication flows. Because these features are intended to be reachable by users to function, they are frequently hosted on internet-facing services. If your application uses these default email features and is reachable from the internet, it is part of the accessible surface area that could be targeted.

When should I prioritize fixing this vulnerability?

Prioritize this if you are running an application that uses the affected Perl plugin with default email handlers enabled. Your first step is to confirm if your specific implementation relies on these default reset or welcome messages. Once you identify instances using these features, plan to update the plugin or modify your configuration to ensure generated links are not based on untrusted request headers.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.