Password reset poisoning: hijacking the link via Host header

Many apps build the reset URL using the HTTP Host header. But that header is client-controlled.

The attack

The attacker triggers a reset for the victim with a tampered Host:

POST /reset HTTP/1.1
Host: evil.com
[email protected]

The email reaches the victim but the link points to evil.com/reset?token=.... If the victim clicks (or the client prefetches), the token goes to the attacker, who resets the password.

Defence

Do not trust the Host header (nor X-Forwarded-Host) to build URLs: use a canonical domain from configuration. Whitelist valid hosts at the web-server level. Single-use, short-lived tokens, invalidated after use.