CVE-2025-56749

n/a / n/a PUBLISHED

Description (CNA)

Creativeitem Academy LMS up to and including 6.14 uses a hardcoded default JWT secret for token signing. This predictable secret allows attackers to forge valid JWT tokens, leading to authentication bypass and unauthorized access to any user account.

Affected (CNA)

Vendor / product	Versions
n/a / n/a	affected n/a

CWE

No CWE identifiers supplied.

References

https://suryadina.com/academy-lms-jwt-secret-7k9m2x4p8q/

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.