# CVE-2026-54631: Part-DB hardcoded APP_SECRET enables forged remember-me authentication

Source: https://junglewise.ai/threats/cve-2026-54631-part-db-is-an-open-source-inventory-management-system-for  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-10-23. Updated: 2026-10-23  
License: CC BY 4.0 with a link back

CVE-2026-54631 · Severity: medium · CVSS 6.3 · Published 2026-10-23

Part-DB is an open-source inventory management system for electronic components. The application uses a hardcoded secret key (committed to the public repository) to sign remember-me cookies, allowing an attacker to forge login sessions as any user—including administrators—without knowing passwords. This grants complete unauthorized access to the inventory system and its data.

Technologies: [Part-DB](https://junglewise.ai/threats/technologies/part-db-part-db). Vendors: [Part-DB](https://junglewise.ai/threats/vendors/part-db).

## Quick answers

**Is CVE-2026-54631 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-54631 being exploited in the wild.

**How severe is CVE-2026-54631?** Medium severity, with a CVSS score of 6.3, published 23 October 2026.

**Which products and versions are affected?** Part-DB 2.12.0 and earlier.

**Is there a fix for CVE-2026-54631?** Yes: fixed in Part-DB 2.12.1. Until then: Generate a new random 32-character APP_SECRET using `openssl rand -hex 32` and set it in `.env.local` or the `environment` section of `docker-compose.yaml` to override the hardcoded value before deployment. Existing deployments must restart containers after this change to invalidate any forged cookies. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-54631 attacked?** It is attacked over the network, in a web application.

**Am I affected by CVE-2026-54631?** Check whether you run Part-DB at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- Fixed in Part-DB 2.12.1

Generate a new random 32-character APP_SECRET using `openssl rand -hex 32` and set it in `.env.local` or the `environment` section of `docker-compose.yaml` to override the hardcoded value before deployment. Existing deployments must restart containers after this change to invalidate any forged cookies.

## Technical details

The vulnerability stems from a hardcoded APP_SECRET value in the committed .env file that is never randomized by the Docker entrypoint. Symfony's SignatureHasher uses this secret as the HMAC-SHA256 key for remember-me cookie authentication. An attacker can either compute forged cookies offline if they obtain a user's bcrypt password hash, or extend any intercepted REMEMBERME cookie to arbitrary future expiry for any target user by recomputing the HMAC with the known secret—no password knowledge required for the latter variant.

## Affected products

- Part-DB Part-DB 2.12.0 and earlier

## Timeline

- 2026-06-16: disclosed
- 2026-06-16: patched: Version 2.12.1 released

## References

- [https://github.com/Part-DB/Part-DB-server/releases/tag/v2.12.1](https://github.com/Part-DB/Part-DB-server/releases/tag/v2.12.1)
- [https://github.com/Part-DB/Part-DB-server/security/advisories/GHSA-99pw-2v29-v4wc](https://github.com/Part-DB/Part-DB-server/security/advisories/GHSA-99pw-2v29-v4wc)

## Related threats

- [Part-DB password reset link poisoning via Host header injection](https://junglewise.ai/threats/cve-2026-86055-part-db-is-an-open-source-inventory-management-system-for)
- [Part-DB spreadsheet formula injection in XLSX export](https://junglewise.ai/threats/cve-2026-86020-part-db-is-an-open-source-inventory-management-system-for)
- [Part-DB attachment size limit bypass via API base64 upload](https://junglewise.ai/threats/cve-2026-86019-part-db-is-an-open-source-inventory-management-system-for)
- [Part-DB attachment file size bypass in server-side downloads](https://junglewise.ai/threats/cve-2026-86018-part-db-is-an-open-source-inventory-management-system-for)
- [Part-DB stored HTML injection in BOM validation via Part name](https://junglewise.ai/threats/cve-2026-55600-part-db-is-an-open-source-inventory-management-system-for)