CVE-2025-56749

critical · 9.4

Creativeitem Academy LMS up to and including 6.14 uses a hardcoded default JWT secret for token signing. This predictable secret allows attackers to forge valid JWT tokens, leading to authentication bypass and unauthorized access to any user account.

9.4

CVSS

0.5%

EPSS (exploit prob.)

40th

EPSS percentile

2025-10-15

Published

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L

Weaknesses

CWE-798

Affected products

Vendor	Product	Affected versions
creativeitem	academy_lms	<= 6.14

Check a specific version with /api/v1/cve/match.

References

https://suryadina.com/academy-lms-jwt-secret-7k9m2x4p8q/

Query this programmatically:

curl https://evil-db.io/api/v1/cve/CVE-2025-56749