password-reset-poisoning 1 Password Reset Poisoning via Referer Header Injection | Grifted Jun 14, 2026