CVE-2026-79575
Severity CVSS v4.0:
Pending analysis
Type:
Unavailable / Other
Publication date:
08/09/2026
Last modified:
08/09/2026
Description
The JWT signing secret in yfexam-exam v2.0 is derived from the username and the current month instead of a random server-side key, making the secret key easily obtainable via a bruteforce attack.