Auth BypassCVSS 9.1critical
4 min read
The Trusted Email That Wasn't
A legitimate password reset email — SPF passed, DKIM valid, sender verified. But the link inside pointed to an attacker's domain. One HTTP header turned a routine email into a full account takeover.
Read case