OPENSUSE-SU-2026:11564-1 perl-Dancer2-Plugin-Auth-Extensible-0.713.0-1.1 on GA media

These are all security issues fixed in the perl-Dancer2-Plugin-Auth-Extensible-0.713.0-1.1 package on the GA media of openSUSE Tumbleweed...

CVE-2026-15689

Dancer2::Plugin::Auth::Extensible versions through 0.713 for Perl allow password reset link poisoning via the request Host header in defaultemailpasswordreset and defaultwelcomesend. Both default emails emit a link of the form $base/login/$code, whose authority comes from the request Host header,...

EUVD-2026-59758

Dancer2::Plugin::Auth::Extensible versions through 0.713 for Perl allow password reset link poisoning via the request Host header in defaultemailpasswordreset and defaultwelcomesend. Both default emails emit a link of the form $base/login/$code, whose authority comes from the request Host header,...

CVE-2026-15689

Dancer2::Plugin::Auth::Extensible through 0.713 trusts the Host header (or X-Forwarded-Host) to build password-reset and welcome links, enabling unauthenticated link poisoning that can lead to account takeover. No patch version is specified; mitigation is to set a trusted uri_base configuration v...

CVE-2026-15689 Dancer2::Plugin::Auth::Extensible versions through 0.713 for Perl allow password reset link poisoning via the request Host header in _default_email_password_reset and _default_welcome_send

Dancer2::Plugin::Auth::Extensible versions through 0.713 for Perl allow password reset link poisoning via the request Host header in defaultemailpasswordreset and defaultwelcomesend. Both default emails emit a link of the form $base/login/$code, whose authority comes from the request Host header,...

CVE-2026-15689

Dancer2::Plugin::Auth::Extensible versions through 0.713 for Perl allow password reset link poisoning via the request Host header in defaultemailpasswordreset and defaultwelcomesend. Both default emails emit a link of the form $base/login/$code, whose authority comes from the request Host header,...

PT-2026-73031

Name of the Vulnerable Software and Affected Versions Dancer2::Plugin::Auth::Extensible versions prior to 0.714 Description Password reset link poisoning is possible via the request Host header in the default email password reset and default welcome send functions. Both default emails generate a...

CVE-2026-13577

Dancer2 versions through 2.1.0 for Perl generate insecure session ids when required CSPRNG modules are unavailable. Dancer2::Core::Role::SessionFactory::generateid silently falls back to a built-in rand-derived session id unless both Math::Random::ISAAC::XS and Crypt::URandom are available. The...

CVE-2026-13577

Dancer2 versions through 2.1.0 for Perl generate insecure session ids when required CSPRNG modules are unavailable. Dancer2::Core::Role::SessionFactory::generateid silently falls back to a built-in rand-derived session id unless both Math::Random::ISAAC::XS and Crypt::URandom are available. The...

CVE-2026-13577

The CVE-2026-13577 entry affects Dancer2 for Perl up to version 2.1.0. When secure PRNG sources (Math::Random::ISAAC::XS, Crypt::URandom) are unavailable, Dancer2::Core::Role::SessionFactory::generate_id falls back to a low-entropy, rand-derived session id. The fallback is computed from a SHA-1 h...

CVE-2026-13577 Dancer2 versions through 2.1.0 for Perl generate insecure session ids when required CSPRNG modules are unavailable

Dancer2 versions through 2.1.0 for Perl generate insecure session ids when required CSPRNG modules are unavailable. Dancer2::Core::Role::SessionFactory::generateid silently falls back to a built-in rand-derived session id unless both Math::Random::ISAAC::XS and Crypt::URandom are available. The...

CVE-2026-13577

Dancer2 versions through 2.1.0 for Perl generate insecure session ids when required CSPRNG modules are unavailable. Dancer2::Core::Role::SessionFactory::generateid silently falls back to a built-in rand-derived session id unless both Math::Random::ISAAC::XS and Crypt::URandom are available. The...

CVE-2026-13577 Dancer2 versions through 2.1.0 for Perl generate insecure session ids when required CSPRNG modules are unavailable

Dancer2 versions through 2.1.0 for Perl generate insecure session ids when required CSPRNG modules are unavailable. Dancer2::Core::Role::SessionFactory::generateid silently falls back to a built-in rand-derived session id unless both Math::Random::ISAAC::XS and Crypt::URandom are available. The...

CVE-2026-13577

Dancer2 versions through 2.1.0 for Perl generate insecure session ids when required CSPRNG modules are unavailable. Dancer2::Core::Role::SessionFactory::generateid silently falls back to a built-in rand-derived session id unless both Math::Random::ISAAC::XS and Crypt::URandom are available. The...

EUVD-2026-45896

Dancer2 versions through 2.1.0 for Perl generate insecure session ids when CSPRNG modules are unavailable. Dancer2::Core::Role::SessionFactory::generateid silently falls back to a built-in rand-derived session id when both Math::Random::ISAAC::XS and Crypt::URandom are unavailable. The fallback...

CVE-2026-13577 Dancer2 versions through 2.1.0 for Perl generate insecure session ids when required CSPRNG modules are unavailable

Dancer2 versions through 2.1.0 for Perl generate insecure session ids when required CSPRNG modules are unavailable. Dancer2::Core::Role::SessionFactory::generateid silently falls back to a built-in rand-derived session id unless both Math::Random::ISAAC::XS and Crypt::URandom are available. The...

Linux Distros Unpatched Vulnerability : CVE-2026-13577

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Dancer2 versions through 2.1.0 for Perl generate insecure session ids when required CSPRNG modules are unavailable...

CVE-2026-12746

Dancer2::Plugin::Auth::OAuth::Provider versions before 0.23 for Perl do not support the OAuth 2.0 state parameter. The authenticationurl method builds the provider authorization redirect without issuing a state value, and the callback method exchanges the callback code and registers the resulting...

CVE-2026-12746 Dancer2::Plugin::Auth::OAuth::Provider versions before 0.23 for Perl do not support the OAuth 2.0 state parameter

Dancer2::Plugin::Auth::OAuth::Provider versions before 0.23 for Perl do not support the OAuth 2.0 state parameter. The authenticationurl method builds the provider authorization redirect without issuing a state value, and the callback method exchanges the callback code and registers the resulting...

EUVD-2026-41686

Dancer2::Plugin::Auth::OAuth::Provider versions before 0.23 for Perl do not support the OAuth 2.0 state parameter. The authenticationurl method builds the provider authorization redirect without issuing a state value, and the callback method exchanges the callback code and registers the resulting...