The BADHOST Bug: Every FastAPI and Starlette App Was Vulnerable and Most Developers Don’t Know It

CVE-2026–48710. One crafted HTTP header. Zero credentials required. Authentication bypassed. Disclosed May 2026, affecting Starlette <…