diff --git a/CHANGELOG.md b/CHANGELOG.md
index bfb72f1..b17b7e6 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -3,6 +3,11 @@ All notable changes to this project will be documented in this file.
 
 The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/).
 
+## 2025-09-02
+
+### Changed
+- Unvalidated-Redirect/Redirect-FalsePositives-GET/Case09... now uses the default host from the first configured engine (identified via JMX) instead of the requested host name (which could have been from a manipulated Host header).
+
 ## 2025-08-30
 - Imported OS Command Injection tests from [Reinforced Wavsep](https://github.com/luigiurbano/Reinforced-Wavsep) at commit [962d566](https://github.com/luigiurbano/Reinforced-Wavsep/commit/962d566ebe51a3f64f772b6c1856d99f1150ba4a).
 
@@ -34,4 +39,4 @@ The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/).
 - JSPs to use correct exceptions.
 
 ### Removed
-- Eclipse files.
\ No newline at end of file
+- Eclipse files.
diff --git a/WebContent/active/Unvalidated-Redirect/Redirect-FalsePositives-GET/inclusion-logic3.jsp b/WebContent/active/Unvalidated-Redirect/Redirect-FalsePositives-GET/inclusion-logic3.jsp
index 5662e2d..fdf89aa 100644
--- a/WebContent/active/Unvalidated-Redirect/Redirect-FalsePositives-GET/inclusion-logic3.jsp
+++ b/WebContent/active/Unvalidated-Redirect/Redirect-FalsePositives-GET/inclusion-logic3.jsp
@@ -2,6 +2,7 @@
 <%@page import="com.sectooladdict.enums.VulnerabilityType"%>
 <%@page import="com.sectooladdict.constants.FileConstants"%>
 <%@page import="com.sectooladdict.validators.InputValidator"%>
+<%@ page import="javax.management.ObjectName,javax.management.MBeanServer,java.lang.management.ManagementFactory,java.util.Set" %>
 
     <%
         //First set the prefix according to the path type
@@ -282,9 +283,24 @@
                     	}
                     					
                     	if (defaultInputType == DefaultInputType.RELATIVE_INPUT) {
+                            // This had previously been using request.getServerName().
+                            // However, that actually means that it 'trusts' the Host
+                            // header from the traffic, which turns this test which was
+                            // meant to be a FP case into a TP case for scenarios when
+                            // headers are being manipulated by a scanner.
+                            // There should only be one configured (default is localhost)
+                            MBeanServer mbs = ManagementFactory.getPlatformMBeanServer();
+                            ObjectName engineObj = new ObjectName("Catalina:type=Engine,*");
+                            Set<ObjectName> engines = mbs.queryNames(engineObj, null);
+                            String defaultHost = "";
+                            if (!engines.isEmpty()) {
+                                ObjectName engine = engines.iterator().next();
+                                defaultHost = (String) mbs.getAttribute(engine, "defaultHost");
+                            }
+
                     		//relative to current dir path
                     		defaultBasePath = FileConstants.HTTP_PREFIX
-                           		+ request.getServerName() + ":" +
+                           		+ defaultHost + ":" +
                     			request.getServerPort() + request.getContextPath() + 
                     			contextRelativeDirPath + "/";
                     		targetFile = defaultBasePath + targetFile;
@@ -346,4 +362,4 @@
     %>
 
 </body>
-</html>
\ No newline at end of file
+</html>