Dropcontact: Idor for firstpromoter service

An IDOR has been detected on firstpromoter service...

Dropcontact: Host Header Injection.

Someone could change the redirection when login out from firstpromoter, by tweaking the logout request and using http X-Forwarded-Host, someone could redirect the logout toward a bad place...