openSUSE-SU-2026:22190-1

Import Source

JSON Data

https://api.osv.dev/v1/vulns/openSUSE-SU-2026:22190-1

Upstream

Related

Published

2026-10-26T15:01:37Z

Modified

2026-11-01T17:23:29Z

Summary

Security update for perl-Dancer2-Plugin-Auth-Extensible

Details

This update for perl-Dancer2-Plugin-Auth-Extensible fixes the following issues:

Changes in perl-Dancer2-Plugin-Auth-Extensible:

updated to 0.714.0 (0.714)
- Fix failing tests when sendmail binary not present on system.
updated to 0.713.0 (0.713)
- Fix the ability to generate links in emails that have dynamic hosts. The security fix in the previous release cached the first base URI, which meant that if an application intentionally supports different hosts for its generated emails (based on the reqest host) then these were always fixed at the first request.
- Add uri_base parameter (addresses CVE-2026-15689). If this is not set and if the application does not otherwise enforce a particular hostname, then an attacker can generate password reset emails and welcome emails for genuine users that contain links to a malicious host. bsc#1275272

References

Affected packages

Name: perl-Dancer2-Plugin-Auth-Extensible
Purl: pkg:rpm/opensuse/perl-Dancer2-Plugin-Auth-Extensible&distro=openSUSE%20Leap%2016.0

Type: ECOSYSTEM
Events: Introduced

0 Unknown introduced version / All previous versions are affected

Fixed

0.714.0-bp160.1.1

{
    "binaries": [
        {
            "perl-Dancer2-Plugin-Auth-Extensible": "0.714.0-bp160.1.1"
        }
    ]
}

source

"https://ftp.suse.com/pub/projects/security/osv/openSUSE-SU-2026:22190-1.json"