CVE-2025-56749
Creativeitem Academy LMS up to and including 6.14 uses a hardcoded default JWT secret for token signing. This predictable secret allows attackers to forge valid JWT tokens, lead…
Published: 2025-10-15 · CVSS: 9.4 · CVSS 3.1
Creativeitem Academy LMS up to and including 6.14 uses a hardcoded default JWT secret for token signing. This predictable secret allows attackers to forge valid JWT tokens, leading to authentication bypass and unauthorized access to any user account.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7