CVE-2026-79575
The JWT signing secret in yfexam-exam v2.0 is derived from the username and the current month instead of a random server-side key, making the secret key easily obtainable via a bruteforce attack.
- Published Sep 8, 2026
- CVSS 7.5 high
- 0.4% chance of exploitation in the next 30 days (EPSS)