Dsa Study Hub CVE-2026-28678
HIGHCVSS VectorNVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N
Lifecycle Timeline
3DescriptionNVD
DSA Study Hub is an interactive educational web application. Prior to commit d527fba, the user authentication system in server/routes/auth.js was found to be vulnerable to Insufficiently Protected Credentials. Authentication tokens (JWTs) were stored in HTTP cookies without cryptographic protection of the payload. This issue has been patched via commit d527fba.
AnalysisAI
DSA Study Hub stores JWT authentication tokens in unencrypted HTTP cookies, allowing attackers to extract and replay user credentials to gain unauthorized access to accounts. An unauthenticated remote attacker can intercept these tokens through network traffic analysis or client-side inspection to impersonate legitimate users. …
Sign in for full analysis, threat intelligence, and remediation guidance.
RemediationAI
Within 24 hours: Assess current DSA Study Hub deployment and confirm vulnerability presence; notify stakeholders of the risk. Within 7 days: Apply the available patch to server/routes/auth.js (commit d527fba or later) across all production and staging environments; conduct verification testing. …
Sign in for detailed remediation steps.
Share
External POC / Exploit Code
Leaving vuln.today