Creativeitem Academy LMS up to and including 6.14 uses a hardcoded default JWT secret for token signing. This predictable secret allows attackers to forge valid JWT tokens, leading to authentication bypass and unauthorized access to any user account.
References
| Link | Resource |
|---|---|
| https://suryadina.com/academy-lms-jwt-secret-7k9m2x4p8q/ | Exploit Mitigation Third Party Advisory |
Configurations
History
21 Oct 2025, 19:24
| Type | Values Removed | Values Added |
|---|---|---|
| First Time |
Creativeitem academy Lms
Creativeitem |
|
| References | () https://suryadina.com/academy-lms-jwt-secret-7k9m2x4p8q/ - Exploit, Mitigation, Third Party Advisory | |
| CPE | cpe:2.3:a:creativeitem:academy_lms:*:*:*:*:*:*:*:* |
15 Oct 2025, 18:15
| Type | Values Removed | Values Added |
|---|---|---|
| CVSS |
v2 : v3 : |
v2 : unknown
v3 : 9.4 |
| CWE | CWE-798 |
15 Oct 2025, 15:16
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2025-10-15 15:16
Updated : 2025-10-21 19:24
NVD link : CVE-2025-56749
Mitre link : CVE-2025-56749
CVE.ORG link : CVE-2025-56749
JSON object : View
Products Affected
creativeitem
- academy_lms
CWE
CWE-798
Use of Hard-coded Credentials