Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2026-86055— Part-DB: Password Reset Link Poisoning via Host Header Injection leads to pre-authentication Account Takeover

Quick assessment

Affected
Part-DB Part-DB-server
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

Part-DB 是一款用于电子元器件管理的开源库存管理系统。在 2.1.3.3 版本之前，Part-DB 在构建通过邮件发送给用户“重置密码”链接的绝对 URL 时，直接使用了客户端提供的 HTTP Host 请求头，且未进行可信主机验证。未认证的攻击者若针对已知账户提交“忘记密码”请求，同时发送伪造的 Host 请求头，即可诱使 Part-DB 向该账户发送一个主机名由攻击者控制、但仍嵌入真实重置令牌的密码重置链接。当受害者打开该链接（或自动化入站邮件安全扫描器解析该链接）时，有效的令牌将被泄露给攻击者；攻击者随

CVSS 8.7 · High

Possible ATT&CK Techniques 1 AI

T1190 · Exploit Public-Facing Application
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-86055

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
Part-DB: Password Reset Link Poisoning via Host Header Injection leads to pre-authentication Account Takeover
Source: CVE Program / CVE List V5
Vulnerability Description
Part-DB is an open source inventory management system for electronic components. Prior to version 2.13.3, Part-DB builds the absolute URL of the password-reset link it emails to a user from the client-supplied HTTP Host header, with no trusted-host validation. An unauthenticated attacker who submits a forgot-password request for a known account while sending a spoofed Host header causes Part-DB to email that account a reset link whose hostname is attacker-controlled, while still embedding the genuine reset token. When the victim opens the link (or an automated inbound mail-security scanner dereferences it), the valid token is disclosed to the attacker, who replays it against the real instance to set a new password and take over the account. Because the seeded admin account can be targeted, this yields full pre-authentication administrative account takeover. This issue has been patched in version 2.13.3.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
Source: CVE Program / CVE List V5
Vulnerability Type
忘记口令恢复机制弱
Source: CVE Program / CVE List V5

Affected Products

Vendor Product Affected Versions CPE Subscribe
Part-DB Part-DB-server < 2.13.3 -

II. Public POCs for CVE-2026-86055

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-86055

请登录查看更多情报信息。

Vendor Advisories for CVE-2026-86055 (1)

Vendor Pages for CVE-2026-86055 (1)

Same Patch Batch · Part-DB · 2026-10-23 · 9 CVEs total

CVE-2026-54630 9.6 CRITICAL Part-DB: Authenticated RCE via .phar attachment upload served from public/media
CVE-2026-54631 6.3 MEDIUM Part-DB: Hardcoded APP_SECRET enables forged remember-me cookie
CVE-2026-54615 6.0 MEDIUM Part-DB: Stored XSS / HTML injection in activity-log Extra column via unsanitized Collecti
CVE-2026-55600 5.7 MEDIUM Part-DB: Stored HTML injection in BOM validation results via unescaped Part name
CVE-2026-59188 5.4 MEDIUM Part-DB: SVG Sanitization Bypass via Extension Spoofing Leads to Stored XSS in Attachment
CVE-2026-86018 5.3 MEDIUM Part-DB: Authenticated Disk Exhaustion via Unbounded Server-Side Attachment Downloads
CVE-2026-86019 5.3 MEDIUM Part-DB: Attachment Size Limit Bypass via API Base64 Upload
CVE-2026-86020 4.6 MEDIUM Part-DB: Spreadsheet Formula Injection in XLSX Part Exports

IV. Related Vulnerabilities

Same product: Part-DB-server
Same vendor: Part-DB
Same weakness: CWE-640

V. Comments for CVE-2026-86055

No comments yet

Leave a comment