Live › vulnerability › CVE-2026-54631
Go to dashboardPart-DB's repository commits a fixed APP_SECRET in its .env file, and the official Docker image does not replace it at startup. An attacker who knows that value can forge remember-me cookies and log in as any user without credentials.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Deployments of Part-DB running a version before 2.12.1 that use the official jbtronics/part-db1 Docker image or the committed .env without overriding APP_SECRET. Installs that set their own APP_SECRET at runtime and use remember-me login are not exposed through this path. Teams not running Part-DB can skip it.
No product ranges from the sources yet.
docker exec <container> printenv APP_SECRET and compare with the value in the public repository's .env file (a03498528f5a5fc089273ec9ae5b2849)2.12.12.12.1 or laterEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
Part-DB is an open source inventory management system for electronic components. Prior to version 2.12.1, the file .env committed in the Part-DB repository contains a fixed value for APP_SECRET (a03498528f5a5fc089273ec9ae5b2849). The official Docker image jbtronics/part-db1 does not override or randomize this value at container start-up. Because Symfony uses APP_SECRET (via kernel.secret) as the HMAC key for signing remember-me cookies, any attacker who knows the secret -- or fetches it from the public repository -- can forge an arbitrary-user remember-me cookie and gain a fully authenticated session with no credentials required. This issue has been patched in version 2.12.1.
This page as .md · .json · in your agent: get_signal("CVE-2026-54631")
NVD data is provided by NIST and is public domain · EPSS scores by FIRST, used with attribution. Posts quoted belong to their authors.