# Host header controls auth and reset URLs

Auth-check, reset-link, or IDP URL built from client-supplied Host or request parameter without strict allowlist

_Area: Web authentication and account takeover. Seen in 3 disclosed reports; latest 2024-04-28. Updated 2026-10-24._

## How it works
A security decision depends on a URL the client can influence. The server builds an auth-check endpoint, password-reset base, or identity-provider URL from the request (Host header or a POST parameter) and then trusts whatever that URL returns or points to. The broken assumption: that the URL identifies a trusted internal or configured resource. When the client controls it, the client controls the trust decision.

## Where it shows up
- `request.getServerName()`, `getHeader("Host")`, or forwarded-host values feeding an internal URL or redirect base [E1](https://bugbountylibrary.com/r/blog%3Aassetnote-io-resources-research-understanding-cve-2022-22972-vmware-workspace-one-access-auth-bypass.md)
- Reset/verification link base derived from the request instead of a configured canonical origin [E2](https://bugbountylibrary.com/r/blog%3Alightningsecurity-io-blog-host-header-injection.md)
- Host validated by suffix match (`.example.com`) rather than exact equality [E2](https://bugbountylibrary.com/r/blog%3Alightningsecurity-io-blog-host-header-injection.md)
- Auth flow accepting an IDP URL/identifier from the client body without checking it against a configured allowlist [E3](https://bugbountylibrary.com/r/h1%3A2401359.md)
- "Any HTTP 200 means authenticated" logic against a URL the client can redirect [E1](https://bugbountylibrary.com/r/blog%3Aassetnote-io-resources-research-understanding-cve-2022-22972-vmware-workspace-one-access-auth-bypass.md)

## How to review
Find every place a URL used for a security decision is constructed. The invariant: the origin/host of any auth-check, reset-link, or IDP URL must come from server-side configuration, never from request data. For Host-derived values, require exact-match against an allowlist, not suffix matching, and parse with the same parser used to build the URL. For IDP parameters, confirm the server rejects any value not in the configured provider list. Trace the response handling: a 200 from an attacker-reachable endpoint must not equal authenticated.

## Variants seen
- Auth-check URL built from Host header; attacker server returns 200, bypassing login [E1](https://bugbountylibrary.com/r/blog%3Aassetnote-io-resources-research-understanding-cve-2022-22972-vmware-workspace-one-access-auth-bypass.md)
- Reset link base from Host header; `?` truncates suffix check, token leaks to attacker domain [E2](https://bugbountylibrary.com/r/blog%3Alightningsecurity-io-blog-host-header-injection.md)
- Client-supplied OpenID 2.0 IDP URL trusted without allowlist check, impersonating any user [E3](https://bugbountylibrary.com/r/h1%3A2401359.md)

## Why fixes fail
Suffix validation of the host is not sufficient: delimiter characters (`?`, `#`, `@`, whitespace) that the URL parser treats as authority terminators break out of the allowed suffix [E2](https://bugbountylibrary.com/r/blog%3Alightningsecurity-io-blog-host-header-injection.md). Validating the host string without matching the parser used downstream leaves a differential.

## Impact and severity
Full authentication bypass and account takeover, including admin accounts [E1](https://bugbountylibrary.com/r/blog%3Aassetnote-io-resources-research-understanding-cve-2022-22972-vmware-workspace-one-access-auth-bypass.md)[E3](https://bugbountylibrary.com/r/h1%3A2401359.md) and reset-token theft [E2](https://bugbountylibrary.com/r/blog%3Alightningsecurity-io-blog-host-header-injection.md). Severity is critical when the bypass reaches privileged users; worse when the trusted URL is also attacker-reachable and returns success by default.

## Evidence
- E1: https://bugbountylibrary.com/r/blog%3Aassetnote-io-resources-research-understanding-cve-2022-22972-vmware-workspace-one-access-auth-bypass.md
- E2: https://bugbountylibrary.com/r/blog%3Alightningsecurity-io-blog-host-header-injection.md
- E3: https://bugbountylibrary.com/r/h1%3A2401359.md