Read the docs
TI-2026-79539 Aliases CVE-2026-54631

Hardcoded APP_SECRET in Part-DB enables forged login cookies

Priority MEDIUM 63CWE-798Published · Updated

Key facts

Attack vector
Local
Privileges required
High
User interaction
None
Attack complexity
Low
Impact type
Security bypass
Confidentiality · integrity · availability
High · High · Low
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-798.

Summary

Part-DB-server before 2.12.1 commits a fixed APP_SECRET value in its .env file, and the official Docker image does not replace it at start-up (CWE-798). Symfony uses this secret to sign remember-me cookies, so anyone who knows it, including anyone who reads the public repository, can forge a cookie for any user and gain an authenticated session without credentials. The CVSS vector requires local access with high privileges. CISA SSVC rates exploitation as proof of concept.

Written with Claude Haiku 5.5 from the sources below · 2026-10-29

Description from the CNA

Part-DB is an open source inventory management system for electronic components. Prior to version 2.12.1, the file .env committed in the Part-DB repository contains a fixed value for APP_SECRET (a03498528f5a5fc089273ec9ae5b2849). The official Docker image jbtronics/part-db1 does not override or randomize this value at container start-up. Because Symfony uses APP_SECRET (via kernel.secret) as the HMAC key for signing remember-me cookies, any attacker who knows the secret -- or fetches it from the public repository -- can forge an arbitrary-user remember-me cookie and gain a fully authenticated session with no credentials required. This issue has been patched in version 2.12.1.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.00191 8th percentileScored 2026-11-07
Fix Fixed Part-DB-server (Part-DB): 2.12.1

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Poc
Automatable
No
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
Part-DBPart-DB-serverbefore 2.12.12.12.1Patch availableCNA
  • Part-DB-server VendorPart-DB Affected before 2.12.1 Fixed in 2.12.1 Patch available CNA

Remediation

Update Part-DB-server to version 2.12.1, which patches this issue.

Written with Claude Haiku 5.5 from the sources below · 2026-10-29

  • Fix · CNA Part-DB-server (Part-DB) Fixed in 2.12.1

Timeline

  1. 2026-10-23 Threatist record created from CVE-2026-54631
  2. 2026-10-23 Priority changed: MEDIUM → LOW
  3. 2026-10-29 CISA SSVC decision points changed
  4. 2026-10-29 Priority changed: LOW → MEDIUM

References

Other 2

  • TI-2026-79546 Password reset link poisoning in Part-DB allows account takeover CVSS 4.0HIGH 8.7
  • TI-2019-15485 Part-DB 0.4 Authentication Bypass via login.php CVSS 4.0HIGH 8.8
  • TI-2026-79538 Part-DB attachment upload allows PHP execution via .phar files CVSS 3.1CRITICAL 9.6
  • TI-2022-00754 OS Command Injection in part-db/part-db CVSS 3.1CRITICAL 9.8
  • TI-2026-79540 Stored HTML injection in Part-DB BOM validation results CVSS 4.0MEDIUM 5.7
  • TI-2025-34870 Part-DB Persistent Denial of Service via Uncaught Exception from Misleading File Extension in Avatar Upload CVSS 3.1MEDIUM 5.7
See all 12 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences