20:34
2026-09-29
dev.to
ai-safety
The Password Reset Email Was Real. The Destination Wasn't.
A security analysis of Coolify's password-reset poisoning vulnerability (GHSA-cgj8-7m5q-x5gv) shows how a chain of trusted forwarded headers, a host-validation cache bug, and a request-derived reset Uā¦