CVE-2026-28678

DSA Study Hub (server/routes/auth.js) is affected. Before commit d527fba, authentication used JWTs stored in HTTP cookies without cryptographic protection of the payload, enabling Insufficiently Protected Credentials. The issue impacts the authentication flow and could allow unauthorized access; ...