{"id":"CVE-2026-86055","kind":"vulnerability","aliases":["CVE-2026-86055"],"related":[],"title":"Part-DB: spoofed Host header leaks password reset tokens to attackers","description":"Part-DB is an open source inventory management system for electronic components. Prior to version 2.13.3, Part-DB builds the absolute URL of the password-reset link it emails to a user from the client-supplied HTTP Host header, with no trusted-host validation. An unauthenticated attacker who submits a forgot-password request for a known account while sending a spoofed Host header causes Part-DB to email that account a reset link whose hostname is attacker-controlled, while still embedding the genuine reset token. When the victim opens the link (or an automated inbound mail-security scanner dereferences it), the valid token is disclosed to the attacker, who replays it against the real instance to set a new password and take over the account. Because the seeded admin account can be targeted, this yields full pre-authentication administrative account takeover. This issue has been patched in version 2.13.3.","summary":"Part-DB builds password-reset links from the request's Host header, so an attacker can make the emailed link point at their own server and capture the genuine token. Replaying that token lets an unauthenticated attacker take over any account, including the seeded admin.","severity":"high","cvss":8.7,"epss":0.004,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["inventory","package","part-db","self-hosted"],"not_affected_if":["password-reset-disabled","version-2.13.3-or-later"],"how_to_check":"Check the installed Part-DB version (unknown how the sources expect it to be read; check the composer.json or release tag).","fix":"Upgrade Part-DB to version 2.13.3 or later.","status":"open","published_at":"2026-10-23T05:17:19+00:00","first_seen_at":"2026-10-23T21:57:32+00:00","triaged_at":"2026-10-23T22:35:06+00:00","updated_at":"2026-10-24T07:15:51+00:00","category":"package","confidence":0.8,"triage":{"at":"2026-10-23T22:35:06Z","model":"claude-haiku-5-5","output":{"fix":"Upgrade Part-DB to version 2.13.3 or later.","reach":"internet","title":"Part-DB: spoofed Host header leaks password reset tokens to attackers","impact":"high","summary":"Part-DB builds password-reset links from the request's Host header, so an attacker can make the emailed link point at their own server and capture the genuine token. Replaying that token lets an unauthenticated attacker take over any account, including the seeded admin.","category":"package","who_cares":["part-db","self-hosted","inventory"],"confidence":0.8,"needs_auth":"no","worst_case":"Attacker takes over the admin account and sets a new password","analyst_note":"Confirm whether the reset flow is enabled by default and whether a Host-header allowlist exists in 2.13.3; check the Part-DB release notes for the fix details.","how_to_check":"Check the installed Part-DB version (unknown how the sources expect it to be read; check the composer.json or release tag).\nunknown","needs_analyst":true,"not_affected_if":["version-2.13.3-or-later","password-reset-disabled"],"user_interaction":"yes","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000514,"input_tokens":3065,"output_tokens":414,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-2026':14A,17A '-86055':15A,18A '2.13.3':90C,232C 'absolut':96C 'account':69B,136C,150C,207C,212C,223C 'admin':73B,211C 'administr':222C 'attack':12A,43B,65B,125C,158C,190C 'attacker-control':157C 'authent':221C 'autom':175C 'build':30B,94C 'captur':55B 'caus':143C 'client':112C 'client-suppli':111C 'compon':86C 'control':159C 'cve':13A,16A 'db':3A,23B,29B,76C,93C,146C 'derefer':181C 'disclos':187C 'electron':85C 'email':47B,105C,148C 'embed':162C 'forgot':130C 'forgot-password':129C 'full':218C 'genuin':57B,164C 'header':6A,40B,116C,142C 'host':5A,26B,39B,115C,121C,141C 'hostnam':155C 'http':114C 'inbound':176C 'includ':70B 'instanc':197C 'inventori':19B,81C 'issu':226C 'known':135C 'leak':7A 'let':62B 'link':34B,48B,103C,153C,172C 'mail':178C 'mail-secur':177C 'make':45B 'manag':82C 'new':201C 'open':79C,170C 'packag':20B 'part':2A,22B,28B,75C,92C,145C 'part-db':1A,21B,27B,74C,91C,144C 'password':8A,32B,101C,131C,202C 'password-reset':31B,100C 'patch':229C 'point':49B 'pre':220C 'pre-authent':219C 'prior':87C 'real':196C 'replay':59B,192C 'request':37B,132C 'reset':9A,33B,102C,152C,165C 'scanner':180C 'secur':179C 'seed':72B,210C 'self':25B 'self-host':24B 'send':138C 'server':53B 'set':199C 'sourc':80C 'spoof':4A,140C 'still':161C 'submit':127C 'suppli':113C 'system':83C 'take':66B,204C 'takeov':224C 'target':215C 'token':10A,58B,61B,166C,185C 'trust':120C 'trusted-host':119C 'unauthent':64B,124C 'url':97C 'user':108C 'valid':122C,184C 'version':89C,231C 'victim':169C 'whose':154C 'yield':217C","nicknames":[],"mitigations":[],"who_affected":null,"tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-23T05:17:19+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"security-advisories@github.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-86055","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-86055","severity":null,"published_at":"2026-10-23T05:17:19+00:00","modified_at":"2026-10-23T19:36:32+00:00","first_seen_at":"2026-10-23T21:57:32+00:00","fetched_at":"2026-10-23T22:29:03+00:00","note":null},{"source":"epss","external_id":"CVE-2026-86055","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-86055","severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-10-24T07:15:51+00:00","fetched_at":"2026-10-25T12:38:51+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}