Password reset poisoning via unkeyed Host header

If the reset email builds its link from the Host header and the CDN does not key on it, you can poison the link or steal tokens.