Part‑DB, an open‑source inventory management system for electronic components, builds an absolute password‑reset URL from the client‑supplied HTTP Host header without validating it. An unauthenticated attacker can submit a forgot‑password request for a valid user while sending a forged Host header. The application then emails a reset link whose hostname is controlled by the attacker, yet the link contains the valid reset token. When the victim opens or a mail‑security scanner dereferences the link, the attacker receives the token. The attacker can replay this token against the genuine instance to set a new password and take over the account, including the seeded administrative account. The issue was fixed in version 2.13.3.

The vulnerability affects Part‑DB servers running any version prior to 2.13.3. The update v2.13.3 removes the insecure construction of the reset link. No other products are listed.

The CVSS score of 8.7 indicates high severity. The EPSS score is not available, so the current exploitation probability is unknown, but the lack of a KEV listing does not preclude real‑world attacks. The attack is pre‑authentication and relies on the ability to trigger a password‑reset email to a known account, which may be feasible through publicly accessible accounts. If the seeded admin account is known, the attacker can obtain full administrative privileges. The exploit requires minimal skills beyond sending a crafted HTTP request with a spoofed Host header and cataloging a password‑reset email.