Is CVE-2026-86055 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-86055 being exploited in the wild.

How severe is CVE-2026-86055?

Informational severity, published 23 October 2026.

How is CVE-2026-86055 attacked?

It is attacked over the network, in a web application.

Am I affected by CVE-2026-86055?

Check whether you run Part-DB at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-86055: Part-DB password reset link poisoning via Host header injection

CVE-2026-86055 · Severity: info · Published 2026-10-23

Part-DB is an open-source inventory management system for electronic components. An unauthenticated attacker can intercept password reset tokens by spoofing the HTTP Host header in a forgot-password request, causing Part-DB to email a reset link pointing to the attacker's server while embedding the valid reset token. When a victim clicks the link, the token is exposed to the attacker, who can then take over any account including the pre-seeded admin account without requiring further authentication.

Technologies: Part-DB. Vendors: Part-DB.

Quick answers

Is CVE-2026-86055 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-86055 being exploited in the wild.
How severe is CVE-2026-86055?: Informational severity, published 23 October 2026.
Which products and versions are affected?: Part-DB before 2.13.3.
Is there a fix for CVE-2026-86055?: Yes: fixed in 2.13.3. Until then: Configure the TRUSTED_HOSTS environment variable with your legitimate hostname(s) to restrict which Host headers are accepted, or disable email-based password reset (ALLOW_EMAIL_PW_RESET=0) if not required. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-86055 attacked?: It is attacked over the network, in a web application.
Am I affected by CVE-2026-86055?: Check whether you run Part-DB at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

Fixed in: 2.13.3

Configure the TRUSTED_HOSTS environment variable with your legitimate hostname(s) to restrict which Host headers are accepted, or disable email-based password reset (ALLOW_EMAIL_PW_RESET=0) if not required.

Technical details

The vulnerability is a Host header injection in password reset link generation: Part-DB constructs absolute URLs for password-reset emails using Symfony's URL generator with the client-supplied Host header, without validating against a trusted-hosts list (which ships empty by default). An unauthenticated attacker submits a forgot-password request with a spoofed Host header; the valid reset token (MD5 of random bytes, embedded in the URL path and email body) is then sent to the attacker-controlled hostname. The attack requires only the victim's username or email and network access to the public /pw_reset/request endpoint, with no user interaction beyond the victim opening a legitimate-looking email from the real Part-DB mail system.

Affected products

Part-DB Part-DB before 2.13.3

Timeline

2026-09-17: advisory
2026-10-23: disclosed
2026-07-19: patched: v2.13.3 released

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.