Live › vulnerability › CVE-2026-86055
Go to dashboardPart-DB builds password-reset links from the request's Host header, so an attacker can make the emailed link point at their own server and capture the genuine token. Replaying that token lets an unauthenticated attacker take over any account, including the seeded admin.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
No product ranges from the sources yet.
Check the installed Part-DB version (unknown how the sources expect it to be read; check the composer.json or release tag).
Upgrade Part-DB to version 2.13.3 or later.
Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
Part-DB is an open source inventory management system for electronic components. Prior to version 2.13.3, Part-DB builds the absolute URL of the password-reset link it emails to a user from the client-supplied HTTP Host header, with no trusted-host validation. An unauthenticated attacker who submits a forgot-password request for a known account while sending a spoofed Host header causes Part-DB to email that account a reset link whose hostname is attacker-controlled, while still embedding the genuine reset token. When the victim opens the link (or an automated inbound mail-security scanner dereferences it), the valid token is disclosed to the attacker, who replays it against the real instance to set a new password and take over the account. Because the seeded admin account can be targeted, this yields full pre-authentication administrative account takeover. This issue has been patched in version 2.13.3.
This page as .md · .json · in your agent: get_signal("CVE-2026-86055")
NVD data is provided by NIST and is public domain · EPSS scores by FIRST, used with attribution. Posts quoted belong to their authors.