This isn't the first time I've seen a vulnerability like this and it surprises me that people who make security focused software still have any of their feature

This isn't the first time I've seen a vulnerability like this and it surprises me that people who make security focused software still have any of their features based on things like headers that are not trustworthy to begin with. If you can fake things like user agents, IPs, hostnames, etc., they shouldn't be relied on for security purposes.