{"schema":"threatline.record/2","record":{"id":"CVE-2026-86055","aliases":["GHSA-m9rf-69wp-c56r"],"summary":"Part-DB: Password Reset Link Poisoning via Host Header Injection leads to pre-authentication Account Takeover","details":"Part-DB is an open source inventory management system for electronic components. Prior to version 2.13.3, Part-DB builds the absolute URL of the password-reset link it emails to a user from the client-supplied HTTP Host header, with no trusted-host validation. An unauthenticated attacker who submits a forgot-password request for a known account while sending a spoofed Host header causes Part-DB to email that account a reset link whose hostname is attacker-controlled, while still embedding the genuine reset token. When the victim opens the link (or an automated inbound mail-security scanner dereferences it), the valid token is disclosed to the attacker, who replays it against the real instance to set a new password and take over the account. Because the seeded admin account can be targeted, this yields full pre-authentication administrative account takeover. This issue has been patched in version 2.13.3.","categories":["Unclassified"],"product":"Part-DB-server","vendor":"Part-DB","ecosystem":null,"affected_ranges":[{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-86055","source_modified_at":"2026-10-23T04:09:27.051Z","fetched_at":"2026-10-23T18:42:43.628194Z","product":"Part-DB-server","vendor":"Part-DB","versions":[{"version":"< 2.13.3","status":"affected"}],"defaultStatus":null},{"source":"GitHub Advisory Database","source_url":"https://github.com/Part-DB/Part-DB-server/security/advisories/GHSA-m9rf-69wp-c56r","source_modified_at":"2026-09-17T15:12:00Z","fetched_at":"2026-10-23T18:42:43.628194Z","package":{"ecosystem":"composer","name":"part-db/part-db-server"},"range":"<= 2.13.2"}],"fixed_versions":[{"source":"GitHub Advisory Database","source_url":"https://github.com/Part-DB/Part-DB-server/security/advisories/GHSA-m9rf-69wp-c56r","source_modified_at":"2026-09-17T15:12:00Z","fetched_at":"2026-10-23T18:42:43.628194Z","package":{"ecosystem":"composer","name":"part-db/part-db-server"},"version":"2.13.3+"}],"cvss":8.7,"severity":"High","kev":{"listed":false},"epss":{"probability":0.004,"percentile":0.33061,"score_date":"2026-10-23"},"published_at":"2026-10-23T04:09:27.051Z","modified_at":"2026-10-23T04:09:27.051Z","provenance":[{"source":"CVE List","url":"https://www.cve.org/CVERecord?id=CVE-2026-86055","fetched_at":"2026-10-23T18:42:43.628194Z","source_modified_at":"2026-10-23T04:09:27.051Z"},{"source":"GitHub Advisory Database","url":"https://github.com/Part-DB/Part-DB-server/security/advisories/GHSA-m9rf-69wp-c56r","fetched_at":"2026-10-23T18:42:43.628194Z","source_modified_at":"2026-09-17T15:12:00Z"},{"source":"EPSS","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-86055","fetched_at":"2026-10-23T18:42:43.628194Z","source_modified_at":"2026-10-23"}],"sources":["CVE List","GitHub Advisory Database","EPSS"],"references":[{"source":"CVE List","url":"https://github.com/Part-DB/Part-DB-server/security/advisories/GHSA-m9rf-69wp-c56r","tags":["x_refsource_CONFIRM"]},{"source":"CVE List","url":"https://github.com/Part-DB/Part-DB-server/releases/tag/v2.13.3","tags":["x_refsource_MISC"]}],"locations":[],"motoko_assessment":{"status":"requires_architecture_review","automatic_remediation":false},"cve_state":"PUBLISHED","cvss_source":"CVE List","classification":{"method":"product-first software-layer rules","rules_version":"2.1","matched_on":null,"confidence":"unknown","reviewed":false},"change_timestamp":"2026-10-23T04:09:27.051Z","content_hash":"a99776d859425e354f79a1f798b57ef139f73ea199afe4db29f5381b82f35226"}}