hi

U.S. Dept Of Defense disclosed on HackerOne: Password Reset link...

**Description:** ████████ uses the Host header when sending out password reset links. This allows an attacker to insert a malicious host header, leading to password reset link / token leakage. ## References http://www.skeletonscribe.net/2013/05/practical-http-host-header-attacks.html https://hackerone.com/reports/226659 ## Impact The victim will receive the malicious link in their email,...