CVE-2026-86055: Part-DB Host Header Poisoning Enables Admin Takeover
An unauthenticated flaw in Part-DB versions below 2.13.3 lets attackers steal password reset tokens by spoofing email links, leading to full account compromise.
Key points
- Part-DB versions prior to 2.13.3 are vulnerable to host header injection during password resets.
- Attackers can steal valid reset tokens by tricking victims into clicking attacker-controlled links.
- The flaw allows unauthenticated takeover of any account, including the default administrative account.
Part-DB, an open-source inventory management system for electronic components, contains a high-severity authentication bypass flaw identified as CVE-2026-86055. The vulnerability affects all versions of Part-DB server prior to 2.13.3. According to the National Vulnerability Database, the issue stems from how the application constructs password-reset emails. It uses the HTTP Host header provided by the client to build the absolute URL for the reset link, without validating that the host is trusted. This design choice exposes any deployment running the affected software to potential account takeover.
How does the attack work?
An unauthenticated attacker initiates a standard "forgot password" request for a known user account. During this process, the attacker submits a spoofed HTTP Host header that points to a domain they control. Part-DB processes this request and sends an email to the victim containing a password-reset link. Crucially, the link’s hostname is the attacker’s domain, but it still contains the genuine, valid reset token generated by the system. The application does not verify that the host header matches its own configured domain before generating the email.
Why is this dangerous for defenders?
The danger lies in the token theft mechanism. When the victim opens the email and clicks the link, their browser sends the valid reset token to the attacker’s server. The attacker then captures this token and replays it against the real Part-DB instance to set a new password. This grants the attacker full access to the victim’s account. Because the attack requires no authentication and targets known accounts, it can be used to compromise the seeded administrative account. This results in complete administrative control over the inventory system without needing to guess passwords or exploit other vulnerabilities.
How does this compare to recent flaws?
This incident mirrors trends seen in other software vulnerabilities reported recently. As Firewall Scoop noted regarding Netherman Portal, missing rate limits and verbose errors can enable brute-force attacks. Similarly, Vikunja version 2.4.0 patched a flaw where plaintext tokens allowed account takeover. The Part-DB issue differs by exploiting email link construction rather than token storage or rate limiting. It highlights how trust in client-supplied headers can lead to credential theft. Defenders should note that while the vector is different, the outcome—unauthorized account access—remains a critical risk for inventory and management systems.
What is the current status?
The vulnerability has been addressed in Part-DB version 2.13.3. Users running versions older than 2.13.3 are exposed to this risk. The National Vulnerability Database rates the severity of CVE-2026-86055 as high, with a CVSS score of 8.7. The weakness is associated with CWE-640. No further patches or mitigations have been announced for earlier versions. Teams must upgrade to the patched version to resolve the host header validation gap.
Detection notes
Security operations teams should monitor email logs for password-reset messages sent to unexpected domains. Look for outbound emails containing reset links that point to external hosts not owned by the organization. Check web server logs for password-reset requests accompanied by unusual or spoofed Host headers.
If you see a user receiving a reset email with a strange domain, investigate immediately. Containment involves disabling password-reset functionality temporarily or forcing password changes for affected accounts. Verify that no unauthorized password changes occurred after suspicious reset requests. Review access logs for new sessions from unfamiliar IP addresses following these events.
Background: National Vulnerability Database
The National Vulnerability Database is the U.S. government’s repository of security flaws in software and hardware. It assigns unique identifiers to each issue, allowing organizations to track, prioritize, and remediate risks using standardized references rather than vague descriptions.
Read the full guide: National Vulnerability Database: Meaning, Structure, and Daily Use
What to do and how to stay safe: Part-DB
- Upgrade Part-DB server to version 2.13.3 or later to apply the vendor-provided fix.
- Monitor outbound email logs for password-reset links containing unauthorized domain names.
- Review authentication logs for unexpected password changes or new admin sessions.
- Implement strict host-header validation at the web server or reverse proxy level.
Step-by-step guide: Patch Management Checklist: Secure Systems Without Breaking Them
General security guidance from the Firewall Scoop newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
Which versions of Part-DB are affected?
All versions of Part-DB server prior to 2.13.3 are vulnerable to this flaw.
Is authentication required to exploit this vulnerability?
No, the attack can be performed by an unauthenticated attacker.
What is the CVSS score for CVE-2026-86055?
The National Vulnerability Database rates it as 8.7, which is high severity.
