CVE-2026-54631
MEDIUM 6.3Part-DB is an open source inventory management system for electronic components. Prior to version 2.12.1, the file .env committed in the Part-DB repository contains a fixed value for APP_SECRET (a03498528f5a5fc089273ec9ae5b2849). The official Docker image jbtronics/part-db1 does not override or randomize this value at container start-up. Because Symfony uses APP_SECRET (via kernel.secret) as the HMAC key for signing remember-me cookies, any attacker who knows the secret -- or fetches it from the public repository -- can forge an arbitrary-user remember-me cookie and gain a fully authenticated session with no credentials required. This issue has been patched in version 2.12.1.
No known exploitation, public exploit, or elevated probability at this time. Track for changes.
Exploitation likelihood
0.1%chance of exploitation in 30 days · 1st percentile
Impact if exploited
6.3CVSS 3.1 · MEDIUM
- ConfidentialityHigh
- IntegrityHigh
- AvailabilityLow
What an attacker needs
- ⚠Access: Requires local access to the host
- ⚠Privileges: Requires an admin / high-privilege account
- ✓User interaction: No user interaction needed
- ✓Complexity: No special conditions — reliably repeatable
✓ lowers the bar for an attacker · ⚠ raises it
Proof of concept
No public PoC is currently catalogued.
Search for new PoCs
Search GitHub now — results may be empty or unverified.
Tracked sources are checked daily for recent CVEs, including PoCs published after the original disclosure. A later release appears after a tracked source lists it and a refresh succeeds.
Data snapshot:
Weakness (CWE)
- CWE-798: : Use of Hard-coded Credentials
CVSS vector
CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:L
References and research data (JSON)
All CVSS metrics
- MEDIUM 6.3 v3.1 · CNA Primary
CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:L - MEDIUM 6.3 v3.1 · NVD Secondary
CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:L
References
Advisories
- https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-108575 EUVD · EUVD-2026-108575
Technical & other
- https://github.com/Part-DB/Part-DB-server/security/advisories/GHSA-99pw-2v29-v4wc CVE record · GitHub_M · Updated 2026-10-23T03:53:33.833Z
NVD · CVE-2026-54631 · Updated 2026-10-23T19:36:32.410 - https://github.com/Part-DB/Part-DB-server/releases/tag/v2.12.1 CVE record · GitHub_M · Updated 2026-10-23T03:53:33.833Z
NVD · CVE-2026-54631 · Updated 2026-10-23T19:36:32.410