Vulnerability in Part-Db Part-Db-Server
CVE-2026-54631
Part-DB is an open source inventory management system for electronic components. Prior to version 2.12.1, the file .env committed in the Part-DB repository contains a fixed value for APP_SECRET (a03498528f5a5fc089273ec9ae5b2849). The official Docker image jbtronics/part-db1 does not override or randomize this value at container start-up. Because Symfony uses APP_SECRET (via kernel.secret) as the HMAC key for signing remember-me cookies, any attacker who knows the secret -- or fetches it from the public repository -- can forge an arbitrary-user remember-me cookie and gain a fully authenticated session with no credentials required. This issue has been patched in version 2.12.1.
Published · last modified .
CVSS v3 metric
CVSS v3 base score 6.3 (Medium). Vector: CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:L.
EPSS exploit prediction
No EPSS score from FIRST.org yet. New CVEs usually get one within a few days; no score means no signal yet, not low risk. How EPSS works.
Affected products
- Part-Db Part-Db-Server — versions < 2.12.1
Weakness classification (CWE)
References
Frequently asked questions
- What is CVE-2026-54631?
- CVE-2026-54631 is a medium-severity vulnerability in Part-Db Part-Db-Server, classified under Use of Hard-coded Credentials. CVSS score: 6.3/10. Published 2026-10-23.
- How severe is CVE-2026-54631?
- Medium severity. CVSS v3 base score is 6.3 out of 10.