EUVD-2026-72912
GHSA-3464-x248-vrcx
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Formula is public and month-space is 12 values, making secret directly computable; I:H added because token forgery enables arbitrary user impersonation and privilege escalation.
Primary rating from Vendor (mitre).
CVSS VectorVendor: mitre
Lifecycle Timeline
5DescriptionCVE.org
The JWT signing secret in yfexam-exam v2.0 is derived from the username and the current month instead of a random server-side key, making the secret key easily obtainable via a bruteforce attack.
AnalysisAI
JWT token forgery in yfexam-exam v2.0 exposes any authenticated session to impersonation because the signing secret is derived entirely from the username and the current calendar month - two low-entropy, often-public values - rather than a server-side cryptographic secret. An attacker who knows or can enumerate a target's username can deterministically compute the signing secret (only 12 possible month values) and mint forged tokens claiming arbitrary privileges without ever knowing the target's password. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | The attacker must know or enumerate at least one target username; registration flows in exam platforms commonly expose usernames via profile pages, email confirmation, or login-error enumeration. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The provided CVSS 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) captures network accessibility and high confidentiality impact but the I:N rating appears to understate actual risk: JWT forgery fundamentally enables impersonation and privilege escalation to any account whose username is known, including administrators, which is a meaningful integrity impact. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Replace the predictable JWT signing secret derivation with a cryptographically random server-side secret of at least 256 bits, generated once at deployment using a CSPRNG (e.g., OpenSSL rand, /dev/urandom, or a framework-native secret generator) and stored securely in server-side configuration - never derived from user-controlled or time-based inputs. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, identify all yfexam-exam v2.0 instances in production and assess business criticality, particularly systems with administrative accounts or sensitive student data. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Same weakness CWE-330 – Use of Insufficiently Random Values
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today