A critical host header injection vulnerability in Dancer2::Plugin::Auth::Extensible allows unauthenticated attackers to hijack user accounts via poisoned password reset communications.

This is a host header injection flaw (CWE-640) occurring in the password reset and welcome email functions. An unauthenticated attacker can manipulate the request Host header to redirect password reset links to an attacker-controlled domain, facilitating credential theft and account takeover.

With a CVSS score of 9.8, this vulnerability represents a critical risk to the confidentiality, integrity, and availability of user accounts. Successful exploitation allows unauthorized access to sensitive user data, potential identity theft, and severe reputational damage to the organization providing the affected service.

Immediate Action: Update ABEVERLEY Dancer2::Plugin::Auth::Extensible to version 0.714 or later immediately.

Proactive Monitoring: Review application logs for anomalous Host headers or unexpected traffic patterns targeting password reset endpoints.

Compensating Controls: Implement strict Host header validation at the Web Application Firewall (WAF) or load balancer level to ensure only authorized domain names are accepted.

Public Exploit Available: No (unknown)

Given the severity of an unauthenticated account takeover vulnerability, organizations using this Perl plugin must prioritize the update to version 0.714. Failure to patch allows attackers to compromise any user account that requests a password reset or welcome email.