0Xkalawy

Name of the Vulnerable Software and Affected Versions: Natours (affected versions not specified) Description: The issue allows an attacker to take over any victim account by injecting an attacker-controlled server domain in the Host header when requesting the "/forgetpassword" endpoint. Recommendations: For all affected versions, update to the version that includes the fix released in commit 7401793a8d9ed0f0c250c4e0ee2815d685d7a70b. As a temporary workaround, consider restricting access to the "/forgetpassword" endpoint until the issue is resolved.