CVE-2026-79575

yfexam-exam v2.0 suffers from a weak JWT signing secret derivation. Instead of using a random server-side key, the secret is constructed from the username and the current month , making it predictable and easily obtainable via a brute-force attack. An attacker who recovers the signing key can for...

EUVD-2026-72912

The JWT signing secret in yfexam-exam v2.0 is derived from the username and the current month instead of a random server-side key, making the secret key easily obtainable via a bruteforce attack...