CVE-2024-26470

The FullStackHero.WebAPI.Boilerplate .NET 8 webapi starter kit (v1.0.0 and v1.0.1) is vulnerable to HTTP Header Injection due to insufficient input validation in the forgotten password functionality. An attacker can manipulate the Host header to leak sensitive password reset tokens by convincing ...