CVE-2026-54631: CWE-798: Use of Hard-coded Credentials in Part-DB Part-DB-server

The Part-DB open source inventory management system for electronic components had a hard-coded APP_SECRET value (a03498528f5a5fc089273ec9ae5b2849) in its .env file prior to version 2.12.1. This secret is used by Symfony's kernel.secret as the HMAC key for signing remember-me cookies. Since the official Docker image jbtronics/part-db1 does not override or randomize this secret at container startup, an attacker with knowledge of the secret (which is publicly accessible in the repository) can forge arbitrary remember-me cookies. This allows the attacker to gain fully authenticated sessions without needing valid credentials. The issue is addressed by patching in version 2.12.1.

An attacker who knows or obtains the hard-coded APP_SECRET can create forged remember-me cookies, enabling them to impersonate any user and gain full authenticated access to the Part-DB-server application without valid credentials. This compromises confidentiality and integrity of the system and user data. The vulnerability requires local or network access to the application but does not require user interaction.

Upgrade Part-DB-server to version 2.12.1 or later, where the hard-coded APP_SECRET issue is fixed. The patch removes the fixed secret from the repository and ensures the secret is randomized or overridden appropriately. Until upgraded, do not use the official Docker image jbtronics/part-db1 in production as it does not mitigate this issue. No other mitigations are specified.