critical9.4
CVE-2025-56749
Creativeitem Academy LMS up to and including 6.14 uses a hardcoded default JWT secret for token signing.
Impact
Creativeitem Academy LMS up to and including 6.14 uses a hardcoded default JWT secret for token signing. This predictable secret allows attackers to forge valid JWT tokens, leading to authentication bypass and unauthorized access to any user account.
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Creativeitem | Academy Lms | through 6.14 |