openSUSE 16 Security Update : perl-Dancer2-Plugin-Auth-Extensible (openSUSE-SU-2026:22190-1)

The remote openSUSE 16 host has a package installed that is affected by a vulnerability as referenced in the openSUSE- SU-2026:22190-1 advisory. Changes in perl-Dancer2-Plugin-Auth-Extensible: - updated to 0.714.0 0.714 Fix failing tests when sendmail binary not present on system. - updated to...

Security update for perl-Dancer2-Plugin-Auth-Extensible (critical)

openSUSE security update: security update for perl-dancer2-plugin-auth-extensible ------------------------------------------------------------- Announcement ID: openSUSE-SU-2026:22190-1 Rating: critical References: bsc1275272 Cross-References: CVE-2026-15689 Affected Products: openSUSE Leap 16.0...

OPENSUSE-SU-2026:22190-1 Security update for perl-Dancer2-Plugin-Auth-Extensible

This update for perl-Dancer2-Plugin-Auth-Extensible fixes the following issues: Changes in perl-Dancer2-Plugin-Auth-Extensible: - updated to 0.714.0 0.714 Fix failing tests when sendmail binary not present on system. - updated to 0.713.0 0.713 Fix the ability to generate links in emails that have...

perl-Dancer2-Plugin-Auth-Extensible-0.713.0-1.1 on GA media (moderate)

perl-Dancer2-Plugin-Auth-Extensible-0.713.0-1.1 on GA media Announcement ID: openSUSE-SU-2026:11564-1 Rating: moderate Cross-References: CVE-2026-15689 Affected Products: openSUSE Tumbleweed An update that solves one vulnerability can now be installed. Description: These are all security issues...

PT-2026-80612

These are all security issues fixed in the perl-Dancer2-Plugin-Auth-Extensible-0.713.0-1.1 package on the GA media of openSUSE Tumbleweed...

CVE-2026-15689

Dancer2::Plugin::Auth::Extensible versions through 0.713 for Perl allow password reset link poisoning via the request Host header in defaultemailpasswordreset and defaultwelcomesend. Both default emails emit a link of the form $base/login/$code, whose authority comes from the request Host header,...

CVE-2026-15689 Dancer2::Plugin::Auth::Extensible versions through 0.713 for Perl allow password reset link poisoning via the request Host header in _default_email_password_reset and _default_welcome_send

Dancer2::Plugin::Auth::Extensible versions through 0.713 for Perl allow password reset link poisoning via the request Host header in defaultemailpasswordreset and defaultwelcomesend. Both default emails emit a link of the form $base/login/$code, whose authority comes from the request Host header,...

EUVD-2026-59758

Dancer2::Plugin::Auth::Extensible versions through 0.713 for Perl allow password reset link poisoning via the request Host header in defaultemailpasswordreset and defaultwelcomesend. Both default emails emit a link of the form $base/login/$code, whose authority comes from the request Host header,...

CVE-2026-15689

Dancer2::Plugin::Auth::Extensible versions through 0.713 for Perl allow password reset link poisoning via the request Host header in defaultemailpasswordreset and defaultwelcomesend. Both default emails emit a link of the form "$base/login/$code", whose authority comes from the request Host heade...

CVE-2026-15689

The Dancer2::Plugin::Auth::Extensible Perl plugin (versions through 0.713 ) is vulnerable to password reset link poisoning . The issue exists in the _default_email_password_reset and _default_welcome_send functions because the application derives the link authority from the untrusted Host header ...

CVE-2026-15689 Dancer2::Plugin::Auth::Extensible versions through 0.713 for Perl allow password reset link poisoning via the request Host header in _default_email_password_reset and _default_welcome_send

Dancer2::Plugin::Auth::Extensible versions through 0.713 for Perl allow password reset link poisoning via the request Host header in defaultemailpasswordreset and defaultwelcomesend. Both default emails emit a link of the form $base/login/$code, whose authority comes from the request Host header,...

CVE-2026-15689

Dancer2::Plugin::Auth::Extensible versions through 0.713 for Perl allow password reset link poisoning via the request Host header in defaultemailpasswordreset and defaultwelcomesend. Both default emails emit a link of the form $base/login/$code, whose authority comes from the request Host header,...

PT-2026-73031

Name of the Vulnerable Software and Affected Versions Dancer2::Plugin::Auth::Extensible versions prior to 0.714 Description Password reset link poisoning is possible via the request Host header in the default email password reset and default welcome send functions. Both default emails generate a...

CVE-2026-15689: Weak Password Recovery Mechanism for Forgotten Password

Dancer2::Plugin::Auth::Extensible versions through 0.713 for Perl allow password reset link poisoning via the request Host header in defaultemailpasswordreset and defaultwelcomesend. Both default emails emit a link of the form $base/login/$code, whose authority comes from the request Host header,...

CVE-2026-12746

Dancer2::Plugin::Auth::OAuth::Provider versions before 0.23 for Perl do not support the OAuth 2.0 state parameter. The authenticationurl method builds the provider authorization redirect without issuing a state value, and the callback method exchanges the callback code and registers the resulting...

CVE-2026-12746

Dancer2::Plugin::Auth::OAuth::Provider versions before 0.23 for Perl do not support the OAuth 2.0 state parameter. The authenticationurl method builds the provider authorization redirect without issuing a state value, and the callback method exchanges the callback code and registers the resulting...

EUVD-2026-41686

Dancer2::Plugin::Auth::OAuth::Provider versions before 0.23 for Perl do not support the OAuth 2.0 state parameter. The authenticationurl method builds the provider authorization redirect without issuing a state value, and the callback method exchanges the callback code and registers the resulting...

CVE-2026-12746: Cross-Site Request Forgery (CSRF)

Dancer2::Plugin::Auth::OAuth::Provider versions before 0.23 for Perl do not support the OAuth 2.0 state parameter. The authenticationurl method builds the provider authorization redirect without issuing a state value, and the callback method exchanges the callback code and registers the resulting...

Paulo Ferreira Dancer2::Plugin::Auth::OAuth::Provider cross-site request forgery vulnerability

Versions prior to 0.23 of Dancer2::Plugin::Auth::OAuth::Provider contain a cross-site request forgery vulnerability. This vulnerability stems from the lack of support for the OAuth 2.0 state parameter; the authenticationurl method fails to generate a state value when constructing authorization...

CVE-2026-11832 Dancer2::Plugin::Auth::OAuth versions before 0.22 for Perl default to a predictable nonce

Dancer2::Plugin::Auth::OAuth versions before 0.22 for Perl default to a predictable nonce. The default nonce was generated using an MD5 hash of the epoch time, which is predictable...