CVE-2026-79575

yfexam-exam v2.0 derives its JWT signing secret from the username and the current month instead of using a randomly generated server-side key, a use of insufficiently random values (CWE-330). Because the secret space is tiny and time-dependent, an unauthenticated, network-adjacent attacker can brute-force the secret for a given username and forge valid JWT tokens for that account without any user interaction. Successful forgery lets the attacker impersonate the targeted user and gain unauthorized access to that account's data and functionality, matching the high confidentiality impact (7.5, AV:N/AC:L/PR:N/UI:N, C:H). Any organization running yfexam-exam v2.0 is affected, and internet-exposed exam portals are the most likely targets. No public proof-of-concept, in-the-wild exploitation, or KEV listing is known, and EPSS puts 30-day exploitation probability at roughly 0.1% (4th percentile).

What to do: Upgrade yfexam-exam to a release that generates a cryptographically random, server-side JWT signing secret once the project publishes a fix, and check your deployed version against the vendor's advisories. As an interim mitigation, if the signing secret is configurable, replace the derived username/month-based secret with a long random value and restart the service, which also invalidates all previously issued tokens; otherwise restrict portal access to trusted networks and monitor for anomalous logins or token use.