Description
The JWT signing secret in yfexam-exam v2.0 is derived from the username and the current month instead of a random server-side key, making the secret key easily obtainable via a bruteforce attack.
High · 7.5
CVE-2026-79575
EUVD-2026-72912GHSA-3464-x248-vrcx
The JWT signing secret in yfexam-exam v2.0 is derived from the username and the current month instead of a random server-side key, making t…
Published Sep 8, 2026 · Updated Sep 9, 2026 · Assigned by mitre