'X-Forwarded-Host' key used in input without sanitation - possible cache poisoning

How it was found

The write-up for this report has not been downloaded yet, or the program disclosed it without one. Read it on HackerOne.