{"id":"openSUSE-SU-2026:22190-1","summary":"Security update for perl-Dancer2-Plugin-Auth-Extensible","details":"This update for perl-Dancer2-Plugin-Auth-Extensible fixes the following issues:\n\nChanges in perl-Dancer2-Plugin-Auth-Extensible:\n\n- updated to 0.714.0 (0.714)\n  * Fix failing tests when sendmail binary not present on system.\n\n- updated to 0.713.0 (0.713)\n  * Fix the ability to generate links in emails that have dynamic hosts. The\n    security fix in the previous release cached the first base URI, which\n    meant that if an application intentionally supports different hosts for\n    its generated emails (based on the reqest host) then these were always\n    fixed at the first request.\n  * Add uri_base parameter (addresses CVE-2026-15689). If this is not set and\n    if the application does not otherwise enforce a particular hostname, then\n    an attacker can generate password reset emails and welcome emails for\n    genuine users that contain links to a malicious host.\n    bsc#1275272\n","modified":"2026-11-01T17:23:29.517103267Z","published":"2026-10-26T15:01:37Z","related":["CVE-2026-15689"],"upstream":["CVE-2026-15689"],"references":[{"type":"ADVISORY"},{"type":"REPORT","url":"https://bugzilla.suse.com/1275272"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2026-15689"}],"affected":[{"package":{"name":"perl-Dancer2-Plugin-Auth-Extensible","ecosystem":"openSUSE:Leap 16.0","purl":"pkg:rpm/opensuse/perl-Dancer2-Plugin-Auth-Extensible&distro=openSUSE%20Leap%2016.0"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.714.0-bp160.1.1"}]}],"ecosystem_specific":{"binaries":[{"perl-Dancer2-Plugin-Auth-Extensible":"0.714.0-bp160.1.1"}]},"database_specific":{"source":"https://ftp.suse.com/pub/projects/security/osv/openSUSE-SU-2026:22190-1.json"}}],"schema_version":"1.9.2"}