Part-DB-server: Password reset link poisoning via Host header leads to admin takeover
Summary
Part-DB builds the password reset link in emails from the client-supplied HTTP Host header without trusted-host validation when TRUSTED_HOSTS is not set. An unauthenticated attacker can request a password reset for a known account, including the seeded admin account, with a spoofed Host header, so the victim receives a valid reset token embedded in a link pointing to an attacker-controlled host. If the victim or an automated mail scanner opens the link, the attacker obtains the token and can set a new password, which leads to full administrative account takeover.
Affected
- Part-DB-server versions before 2.13.3 (CNA data: < 2.13.3; vendor advisory: <= 2.13.2)
- Relevant only if email-based password reset is enabled (ALLOW_EMAIL_PW_RESET=1) and TRUSTED_HOSTS is empty
- Scoring differs between sources: CNA/NVD CVSS 4.0 8.7 (High); VulDB CVSS 7.3
Fixed in
- Part-DB 2.13.3 ensures that the password reset link always points to a trustable host.
- Newer releases exist (2.13.4 and 2.14.x are listed on the release page); check the current stable release and its changelog before upgrading.
Workaround
- Set the TRUSTED_HOSTS environment variable to the legitimate hostname of the instance. The 2.13.3 release recommends this; its effectiveness against this issue is not confirmed by the vendor advisory in the sources available to us.
- Disable email-based password reset (ALLOW_EMAIL_PW_RESET) if it is not required.
- Restrict network access to the instance.
Exploitation
- CISA SSVC: exploitation status 'poc', automatable: yes, technical impact: total.
- VulDB states that no exploit exists; one aggregator lists a PoC count that could not be verified.
- No evidence of exploitation in the wild found; no CISA KEV listing found.
- Exploitation status should be treated as unknown rather than absent.
Our recommendation
- Upgrade all Part-DB instances to 2.13.3 or later, preferably the current stable release.
- Set TRUSTED_HOSTS and disable email password reset if patching is delayed.
- Check whether the instance is reachable from the internet; internal-only installs are less exposed.
- Review admin accounts for unexpected password resets and check mail logs for reset requests users did not make.
- Use strong, unique passwords and MFA for admin accounts where supported.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- Part-DB 2.13.3 release github.com
- GitHub Security Advisory GHSA-m9rf-69wp-c56r github.com
- VulDB entry 425567 vuldb.com
- Vulners CVE-2026-86055 vulners.com
- Part-DB releases github.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 1 Nov 2026, 00:33.
Original description (NVD)
Part-DB is an open source inventory management system for electronic components. Prior to version 2.13.3, Part-DB builds the absolute URL of the password-reset link it emails to a user from the client-supplied HTTP Host header, with no trusted-host validation. An unauthenticated attacker who submits a forgot-password request for a known account while sending a spoofed Host header causes Part-DB to email that account a reset link whose hostname is attacker-controlled, while still embedding the genuine reset token. When the victim opens the link (or an automated inbound mail-security scanner dereferences it), the valid token is disclosed to the attacker, who replays it against the real instance to set a new password and take over the account. Because the seeded admin account can be targeted, this yields full pre-authentication administrative account takeover. This issue has been patched in version 2.13.3.
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.