writeups.xyz / Password Reset Token Leak via X-Forwarded-Host

Submitter : c2a

Date: 26 February 2021

Bounty : 1,000

Vulnerabilities :

• Host Header Injection
• Account Takeover
• Password Reset

Programs :

• Undisclosed

Authors :

• Saajan Bhujel (@Saajanbhujel)

Link :
https://saajan.bhujel.cyou/blog/web/2021-02-26-password-reset-token-leak-via-x-forwarded-host