Lab: Basic password reset poisoning
Summary: PortSwigger's lab demonstrates password reset poisoning: the POST /forgot-password request accepts an arbitrary Host header, so the reset email sent to a user contains a link pointing at the attacker's domain. By setting the Host header to their exploit server and the username parameter to carlos, the attacker captures Carlos's temp-forgot-password-token in the access log and uses it to reset his password and log in.
Why it matters: The reset token lands in the attacker's access log simply because the application trusted a client-supplied Host header when building the email link - a single unvalidated header turns a routine account-recovery flow into full account takeover for any user who clicks the link.
Read the original at PortSwigger Research ↗
- Topics
- Vulnerabilities & Patching
- Related
- Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026U.S. CISA adds Check Point and UnrealIRCd flaws to its Known Exploited Vulnerabilities catalog Cyber Risks · Nov 14, 2026PostgreSQL Patches 52 Flaws, Including 22-Year-Old Bug Enabling Authenticated RCE Cyber Risks · Nov 13, 2026