Host header / password reset poisoning
Absolute URLs built from the request Host. Classic in Django, Rails, Laravel password-reset mailers and in CDN cache keys that ignore Host.
Tags: host-header, ato, cache
Typical severity: P2-P4
What it becomes
If the Host (or X-Forwarded-Host) is copied into a reset email, you steal accounts. If it is copied into asset URLs and cached, you poison the cache.
Where to look
password resetinvite emailsunsubscribe linksOG tagssitemap
Chains
- ATO — Reset email points at attacker host; victim clicks; token lands on you.
- Cache poison — Host is unkeyed; HTML with attacker asset hosts is cached for everyone.
Notes
- Many apps ignore Host but honour X-Forwarded-Host or Forwarded. Test each.
- A duplicate Host header (HTTP request smuggling / HPP) is a related parser gadget.