All vulnerabilities
CVE-2026-54631GHSA-99pw-2v29-v4wc

Part-DB-server: Part-DB: Hardcoded APP_SECRET enables forged remember-me cookie

Part-DB Part-DB-server
Open in ThreatlineRecord JSON
CVSS
6.3Medium
ExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)0.11%Chance of exploitation activity in the next 30 days, higher than 1% of CVEs. Scored 23 Oct 2026FIRST EPSS
Fixed in2.12.1+Fixed versionGitHub
Published23 Oct 2026Updated 23 Oct 2026CVE List

What fixes it

  • 2.12.1+part-db/part-db-serverGitHub

A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.

Description

Part-DB is an open source inventory management system for electronic components. Prior to version 2.12.1, the file .env committed in the Part-DB repository contains a fixed value for APP_SECRET (a03498528f5a5fc089273ec9ae5b2849). The official Docker image jbtronics/part-db1 does not override or randomize this value at container start-up. Because Symfony uses APP_SECRET (via kernel.secret) as the HMAC key for signing remember-me cookies, any attacker who knows the secret -- or fetches it from the public repository -- can forge an arbitrary-user remember-me cookie and gain a fully authenticated session with no credentials required. This issue has been patched in version 2.12.1.

Text from CVE List

Affected versions 2

  • Part-DB-serveraffected: < 2.12.1CVE List
  • part-db/part-db-server<=2.12.0GitHub

References 2