Part-DB CVE-2026-54631

Affected deployments are default installations of the official jbtronics/part-db1 Docker image at v2.12.0 or earlier where the operator has NOT overridden APP_SECRET in .env.local or the docker-compose environment section - the entrypoint never randomizes it, so the committed value stays active. Exploitation additionally requires ONE of: (variant 1) possession of the target user's bcrypt password hash, obtainable only through a separate issue such as a DB dump or SQL injection, which the vendor notes is 'not obtainable without another security issue'; or (variant 2) interception of any valid REMEMBERME cookie from any logged-in user, via logged XSS or network interception, since the fieldsHash is embedded in cleartext in the cookie's last 44 characters. Key limiter: instances where the administrator set a custom random APP_SECRET are NOT exploitable; there is no user-interaction or privilege requirement on the target itself.

This is a genuine authentication-bypass flaw (CWE-798, hardcoded secret) but its real-world priority is moderate, consistent with the vuln.today 'this_month' label and the vendor's own MEDIUM rating of this specific issue. The supplied CVSS vector (CVSS:3.1/AV:L/AC:L/PR:H/UI:N, 6.3) conflicts with the description and GHSA advisory: the vector claims local access and high privileges, yet the described attack is a remotely submitted forged remember-me cookie requiring no credentials on the target - these signals are contradictory and the official AV:L/PR:H appears to understate the network exploitability. The true limiting factor is not local access but a precondition: variant 1 (offline forgery) needs the victim's bcrypt hash, obtainable only via a separate flaw such as a DB dump or SQL injection, and variant 2 (cookie extension) needs an intercepted valid REMEMBERME cookie (via XSS or network interception). The GHSA advisory contains functional, live-validated proof-of-concept code for both variants against a default Docker v2.12.0 deployment, which raises practical risk above the raw score. No CISA KEV listing and no EPSS score were provided; there is no evidence of active in-the-wild exploitation. Net: a real, broadly-applicable weakness in default Docker installs that should be patched promptly, but gated by a prerequisite (hash or cookie) that keeps it from being trivial drive-by unauthenticated compromise.

An attacker reads the hardcoded APP_SECRET (a03498528f5a5fc089273ec9ae5b2849) straight from the public Part-DB repository, then either obtains the admin's bcrypt hash from a leaked DB backup, or intercepts any logged-in user's REMEMBERME cookie whose fieldsHash is embedded in cleartext. Using the known secret they recompute a valid HMAC-SHA256 signature for the admin username with a decade-long expiry and submit it as a cookie, gaining a fully authenticated admin session without a password. The GHSA advisory includes working PoC code for both paths and states both were live-validated against a default Docker deployment of v2.12.0.