CET Grading System CVE-2026-14609

Exploitation requires that the CET Automated Grading System accept and persist an attacker-supplied session identifier across the authentication boundary without server-side token regeneration - the defining condition of CWE-384. The attacker must have a mechanism to deliver the pre-set session token to the victim's browser (e.g., a crafted URL parameter or cookie injection via a secondary vector), and the victim must subsequently authenticate to the application using that token. The CVSS AC:H rating reflects the coordination overhead of this setup. Limiting factors: the attacker must successfully deliver the fixed session ID to the victim's browser prior to authentication, which typically requires social engineering or a co-located network position; the impact is limited to the authenticated user's session scope within version 1.0 of this specific application; no privilege escalation beyond the victim's role is implied by the available data. The PR:N metric confirms no attacker authentication is required.

The CVSS 4.0 base score of 2.9 (AV:N/AC:H/AT:N/PR:N/UI:N) reflects network reachability but constrained practical exploitability due to high attack complexity (AC:H). The E:P supplemental metric and the description's explicit statement that 'the exploit is now public' confirm publicly available exploit code - a meaningful escalation beyond theoretical risk. However, the product is not in the CISA KEV and no EPSS data was provided, so widespread or opportunistic exploitation is not confirmed. The impact is capped at Low across all three CIA pillars with no subsequent-system impact (SC/SI/SA:N), limiting the blast radius to the compromised user's session. Real-world priority is low: the high complexity prerequisite, niche product footprint, and bounded impact together suggest this is a low-urgency finding absent evidence of targeted exploitation.

An attacker crafts a URL embedding a known session token value and delivers it to a target user via phishing or a secondary injection point. When the victim clicks the link and authenticates to the CET Grading System, the server assigns the attacker's pre-set session ID to the now-authenticated session without regenerating it. The attacker then submits requests to the application using that same known session token, gaining access to the victim's grades, student records, and any other session-scoped data. A public exploit is available per VulDB CTI reference https://vuldb.com/vuln/376117/cti, lowering the technical barrier for this scenario.