CVE-2026-79575: n/a

CVE-2026-79575 describes a vulnerability in yfexam-exam v2.0 where the JWT signing secret is derived from predictable inputs—the username and the current month—instead of a cryptographically secure random key. This predictable key generation enables attackers to perform brute force attacks to obtain the secret key, compromising the confidentiality of JWT tokens. The vulnerability is classified under CWE-330 (Use of Insufficiently Random Values). The CVSS 3.1 base score is 7.5 (High), with attack vector network, low attack complexity, no privileges required, no user interaction, and impact limited to confidentiality.

An attacker can recover the JWT signing secret by brute forcing predictable inputs, allowing them to forge or decrypt JWT tokens. This compromises the confidentiality of sensitive information contained in the tokens. There is no indication of integrity or availability impact. No known exploits are reported in the wild.

No official patch or fix is currently available. Users should monitor vendor advisories for updates. As a mitigation, avoid using predictable inputs for JWT signing secrets and implement a cryptographically secure random key generation mechanism for signing tokens.