# CVE-2026-86055: Part-DB password reset link poisoning via Host header injection

Source: https://junglewise.ai/threats/cve-2026-86055-part-db-is-an-open-source-inventory-management-system-for  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-10-23. Updated: 2026-10-23  
License: CC BY 4.0 with a link back

CVE-2026-86055 · Severity: info · Published 2026-10-23

Part-DB is an open-source inventory management system for electronic components. An unauthenticated attacker can intercept password reset tokens by spoofing the HTTP Host header in a forgot-password request, causing Part-DB to email a reset link pointing to the attacker's server while embedding the valid reset token. When a victim clicks the link, the token is exposed to the attacker, who can then take over any account including the pre-seeded admin account without requiring further authentication.

Technologies: [Part-DB](https://junglewise.ai/threats/technologies/part-db-part-db). Vendors: [Part-DB](https://junglewise.ai/threats/vendors/part-db).

## Quick answers

**Is CVE-2026-86055 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-86055 being exploited in the wild.

**How severe is CVE-2026-86055?** Informational severity, published 23 October 2026.

**Which products and versions are affected?** Part-DB before 2.13.3.

**Is there a fix for CVE-2026-86055?** Yes: fixed in 2.13.3. Until then: Configure the TRUSTED_HOSTS environment variable with your legitimate hostname(s) to restrict which Host headers are accepted, or disable email-based password reset (ALLOW_EMAIL_PW_RESET=0) if not required. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-86055 attacked?** It is attacked over the network, in a web application.

**Am I affected by CVE-2026-86055?** Check whether you run Part-DB at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- Fixed in 2.13.3

Configure the TRUSTED_HOSTS environment variable with your legitimate hostname(s) to restrict which Host headers are accepted, or disable email-based password reset (ALLOW_EMAIL_PW_RESET=0) if not required.

## Technical details

The vulnerability is a Host header injection in password reset link generation: Part-DB constructs absolute URLs for password-reset emails using Symfony's URL generator with the client-supplied Host header, without validating against a trusted-hosts list (which ships empty by default). An unauthenticated attacker submits a forgot-password request with a spoofed Host header; the valid reset token (MD5 of random bytes, embedded in the URL path and email body) is then sent to the attacker-controlled hostname. The attack requires only the victim's username or email and network access to the public /pw_reset/request endpoint, with no user interaction beyond the victim opening a legitimate-looking email from the real Part-DB mail system.

## Affected products

- Part-DB Part-DB before 2.13.3

## Timeline

- 2026-09-17: advisory
- 2026-10-23: disclosed
- 2026-07-19: patched: v2.13.3 released

## References

- [https://github.com/Part-DB/Part-DB-server/releases/tag/v2.13.3](https://github.com/Part-DB/Part-DB-server/releases/tag/v2.13.3)
- [https://github.com/Part-DB/Part-DB-server/security/advisories/GHSA-m9rf-69wp-c56r](https://github.com/Part-DB/Part-DB-server/security/advisories/GHSA-m9rf-69wp-c56r)

## Related threats

- [Part-DB spreadsheet formula injection in XLSX export](https://junglewise.ai/threats/cve-2026-86020-part-db-is-an-open-source-inventory-management-system-for)
- [Part-DB attachment size limit bypass via API base64 upload](https://junglewise.ai/threats/cve-2026-86019-part-db-is-an-open-source-inventory-management-system-for)
- [Part-DB attachment file size bypass in server-side downloads](https://junglewise.ai/threats/cve-2026-86018-part-db-is-an-open-source-inventory-management-system-for)
- [Part-DB stored HTML injection in BOM validation via Part name](https://junglewise.ai/threats/cve-2026-55600-part-db-is-an-open-source-inventory-management-system-for)
- [Part-DB hardcoded APP_SECRET enables forged remember-me authentication](https://junglewise.ai/threats/cve-2026-54631-part-db-is-an-open-source-inventory-management-system-for)