How I Bypassed Account Verification with a Simple Host Header Trick

Hey Security Enthusiasts,

I hope you’re all doing great. Today, I’m sharing a critical vulnerability I discovered that led to both verification bypass and authentication bypass — a pretty dangerous combination if left unchecked. It’s one of those bugs that shows how something as simple as a manipulated header can have a big impact.

Host Header Injection is a type of web vulnerability where an attacker manipulates the Host header of an HTTP request to force a server to generate links, redirects, or behaviors that point to an attacker-controlled domain. This typically happens when the backend relies on the Host header for generating absolute URLs, verification links, or redirects—without validating if it actually belongs to the trusted domain.

If exploited properly, this can lead to a wide range of attacks:

Token or link hijacking
Internal access exposure
Open redirect
Bypassing verification or authentication steps

Let’s walk through how this happened on the target platform.