---
id: "CVE-2026-86055"
kind: "vulnerability"
aliases: ["CVE-2026-86055"]
title: "Part-DB: spoofed Host header leaks password reset tokens to attackers"
severity: "high"
cvss: 8.7
epss: 0.004
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["inventory", "package", "part-db", "self-hosted"]
not_affected_if: ["password-reset-disabled", "version-2.13.3-or-later"]
published_at: "2026-10-23T05:17:19+00:00"
first_seen_at: "2026-10-23T21:57:32+00:00"
updated_at: "2026-10-24T07:15:51+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-86055", "first_seen_at": "2026-10-23T21:57:32+00:00"}, {"source": "epss", "url": "https://api.first.org/data/v1/epss?cve=CVE-2026-86055", "first_seen_at": "2026-10-24T07:15:51+00:00"}]
---

# Part-DB: spoofed Host header leaks password reset tokens to attackers

Part-DB builds password-reset links from the request's Host header, so an attacker can make the emailed link point at their own server and capture the genuine token. Replaying that token lets an unauthenticated attacker take over any account, including the seeded admin.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

Check the installed Part-DB version (unknown how the sources expect it to be read; check the composer.json or release tag).

## Fix

Upgrade Part-DB to version 2.13.3 or later.

## Timeline

- 2026-10-23T21:57:32+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-86055
- 2026-10-24T07:15:51+00:00 epss https://api.first.org/data/v1/epss?cve=CVE-2026-86055

## From the sources

Part-DB is an open source inventory management system for electronic components. Prior to version 2.13.3, Part-DB builds the absolute URL of the password-reset link it emails to a user from the client-supplied HTTP Host header, with no trusted-host validation. An unauthenticated attacker who submits a forgot-password request for a known account while sending a spoofed Host header causes Part-DB to email that account a reset link whose hostname is attacker-controlled, while still embedding the genuine reset token. When the victim opens the link (or an automated inbound mail-security scanner dereferences it), the valid token is disclosed to the attacker, who replays it against the real instance to set a new password and take over the account. Because the seeded admin account can be targeted, this yields full pre-authentication administrative account takeover. This issue has been patched in version 2.13.3.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_