Making HTTP header injection critical with one prompt

PortSwigger Research has introduced a new scan check that escalates HTTP header injection to a CRLF-powered desync attack in a single prompt, the company says. The technique can serve other users a redirect to an attacker-controlled collaborator server, turning a lower-severity flaw into a critical one.