Password reset poisoning via unkeyed Host header
If the reset email builds its link from the Host header and the CDN does not key on it, you can poison the link or steal tokens.
Tag: cache
Web cache deception on authenticated pages
Trick a CDN into caching a victim's private page by appending a static-looking extension the origin ignores but the cache keys on.