Lab: Host header authentication bypass
Summary: PortSwigger's Web Security Academy lab demonstrates a host header authentication bypass in which an application decides a user's privilege level from the HTTP Host header. The solution changes the Host header to localhost on a GET /admin request, which grants access to the admin panel, and then sends GET /admin/delete?username=carlos to delete the user carlos.
What's compelling: The application trusted a client-supplied header to decide who counts as a local user, so a single header value stood between an ordinary request and the admin panel's user-deletion function.
Read the original at PortSwigger Research ↗
- Topics
- Vulnerabilities & Patching
- Related
- Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026U.S. CISA adds Check Point and UnrealIRCd flaws to its Known Exploited Vulnerabilities catalog Cyber Risks · Nov 14, 2026PostgreSQL Patches 52 Flaws, Including 22-Year-Old Bug Enabling Authenticated RCE Cyber Risks · Nov 13, 2026