CVE-2026-25600 Credential Exposure Vulnerability in Trac PDBM
Attackers with local access can extract a hardcoded secret to decrypt credentials and gain administrative privileges in the PDBM application.
- Exploited in the wild
- Not known
- Login needed
- An administrator
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-25600?
CVE-2026-25600 is a medium-severity vulnerability in Trac d.o.o. PDBM, published on 1 Jun 2026. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
The PDBM application relies on a static, hard‑coded secret embedded in the PDBM.exe executable. This secret is used by the application’s encryption routines, including the function responsible for decrypting credentials stored in the product’s configuration file. Because the secret is constant across installations, any attacker with sufficient local privileges can extract it from the binary. Once obtained, the secret allows the attacker to decrypt the stored password and authenticate as the user defined in the configuration file. In the affected version, this user account is configured with administrative privileges, granting full access to PDBM’s management interface and its underlying operational functions.
Weakness: CWE-798
Which versions are affected by CVE-2026-25600?
How do I fix CVE-2026-25600?
No fix has been published for CVE-2026-25600 yet. Limit exposure of the affected software until one is available.
Is CVE-2026-25600 being exploited?
There is no known exploitation of CVE-2026-25600 in the wild and no public exploit code.
Sources
Also known as GHSA-9pjg-jh77-2mjg.