Host header injection

When it applies

The server trusts the Host (or X-Forwarded-Host) header to build absolute URLs, decide routing, or key a cache. Classic impact: password-reset poisoning (the reset link points at your domain, so the victim's token comes to you).

Why it works

Frameworks read the request host to construct links (https://{host}/reset?token=…). The host is attacker-controlled, so if it isn't validated against an allowlist, you control where generated links point — and where secrets in them land.