A hardcoded APP_SECRET value in the Part-DB server’s .env file is used by Symfony as the HMAC key for signing remember‑me cookies. Because the secret is publicly accessible, an attacker can craft a cookie that appears to be properly signed and obtain an authenticated session without providing any credentials. This flaw is a classic example of the CWE‑798 vulnerability, where a fixed secret enables an attacker to forge cryptographic tokens.

The vulnerability affects the Part‑DB server (open‑source inventory management system for electronic components). All releases prior to version 2.12.1, including the official Docker image jbtronics/part-db1, contain the hardcoded APP_SECRET. Users running any of these earlier releases without a custom override of APP_SECRET are vulnerable.

The CVSS score of 6.3 indicates a moderate severity. The EPSS score is not available, so the current exploit probability cannot be precisely quantified, but the lack of obscurity for the secret and the ability to obtain it from the public repository suggest a favorable attack vector. The flaw is listed in no KEV catalog. Attackers can obtain the secret from the repository and forge a remember‑me cookie remotely, obtaining full authenticated access to the application. Due to the ease of creating the forged cookie, the risk of exploitation is significant for systems that have not applied the 2.12.1 patch or an equivalent secret override.