CVE-2026-15689 Dancer2::Plugin::Auth::Extensible versions through 0.713 for Perl allow password reset link poisoning via the request Host header in _default_email_password_reset and _default_welcome_send

[
  {
    "collectionURL": "https://cpan.org/modules",
    "defaultStatus": "unaffected",
    "packageName": "Dancer2-Plugin-Auth-Extensible",
    "product": "Dancer2::Plugin::Auth::Extensible",
    "programFiles": [
      "lib/Dancer2/Plugin/Auth/Extensible.pm"
    ],
    "programRoutines": [
      {
        "name": "Dancer2::Plugin::Auth::Extensible::_default_email_password_reset"
      },
      {
        "name": "Dancer2::Plugin::Auth::Extensible::_default_welcome_send"
      },
      {
        "name": "Dancer2::Plugin::Auth::Extensible::password_reset_send"
      }
    ],
    "repo": "https://github.com/PerlDancer/Dancer2-Plugin-Auth-Extensible",
    "vendor": "ABEVERLEY",
    "versions": [
      {
        "lessThanOrEqual": "0.713",
        "status": "affected",
        "version": "0",
        "versionType": "custom"
      }
    ]
  }
]