Wonder what the vulnerability is? I can send any host header I like if I make a request from outside a browser. Maybe some special localhost magic baked into th

Wonder what the vulnerability is? I can send any host header I like if I make a request from outside a browser. Maybe some special localhost magic baked into the Core self-host...