CVE-2026-86055: CWE-640: Weak Password Recovery Mechanism for Forgotten Password in Part-DB Part-DB-server

Part-DB-server before version 2.13.3 builds the absolute URL for password reset emails using the HTTP Host header supplied by the client without validating the hostname. An attacker can submit a password reset request with a spoofed Host header, causing the reset email to contain a link with an attacker-controlled hostname but a genuine reset token. When the victim or an automated mail scanner accesses this link, the attacker obtains the valid token and can use it to reset the password on the real server, leading to account takeover. This vulnerability affects all accounts, including the seeded administrative account, enabling full pre-authentication administrative control. The vulnerability is fixed in version 2.13.3.

An unauthenticated attacker can perform a password reset attack by tricking the system into sending a reset link with a malicious hostname containing a valid reset token. This allows the attacker to capture the token and reset the password of any user, including the administrator, resulting in full administrative account takeover without prior authentication.

This vulnerability has been patched in Part-DB-server version 2.13.3. Users should upgrade to version 2.13.3 or later to remediate this issue. No other mitigations are indicated by the vendor advisory.