Account Takeover Vulnerability in Part-DB Inventory Management System

CVE-2026-86055

What is CVE-2026-86055?

Part-DB, an open-source inventory management system for electronic components, had a significant security flaw prior to version 2.13.3. The system incorrectly built password-reset URLs using the HTTP Host header provided by clients without any validation. This oversight allowed an unauthenticated attacker to exploit the system by sending a forged password-reset request. The attacker could manipulate the Host header to direct the password-reset link to a malicious domain. When the victim interacts with this link, the attacker's server receives a valid reset token, enabling them to hijack the user's account. This vulnerability posed a severe risk particularly for admin accounts as it facilitated full administrative control over the affected Part-DB instance.

References