Expected Findings
- Reset link is built using `Host` or `X-Forwarded-Host` from the request.
- No allow-list of accepted hosts.
- Same flaw on email verification, invite, and magic-link flows.
Password Reset Mailer
Host Header Injection
The reset mailer builds the link from the inbound `Host` header without an allow-list, so an attacker can poison the request via a CDN or proxy and steer the reset link to their domain.
CWE-644CWE-201
Host injection probe
Primary Flows
- Forgot endpoint Reflects Host header
- Mailer audit Shows poisoned link
Signals
Bug
link := "https://" + r.Host + "/reset?token=" + token