CVE-2026-28678

dsa-hub-server: Clear-Text Storage of Sensitive Data

CVSS 8.1 HIGHEPSS 0.2%CWE-311 CWE-522

Vexday Risk Score

21Low

SSVC decision (CISA)

Track

No exploitation signal → monitor

CVSS 8.1EPSS 0.2%KEV nãoPoC —Nuclei —Metasploit —Patch —

Lifecycle

07 Mar 2026Published on NVD

Recommendation: Monitor — no exploitation signal at the moment.

DSA Study Hub is an interactive educational web application. Prior to commit d527fba, the user authentication system in server/routes/auth.js was found to be vulnerable to Insufficiently Protected Credentials. Authentication tokens (JWTs) were stored in HTTP cookies without cryptographic protection of the payload. This issue has been patched via commit d527fba.

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N

Affected products

toxicbishop · DSA-with-tsx

Want to know if your infrastructure is exposed to this?

Talk to TrueHacking →

References

https://github.com/toxicbishop/DSA-with-tsx/commit/d527fba3b3c15f185b9d1e730322dff9248391e4 https://github.com/toxicbishop/DSA-with-tsx/security/advisories/GHSA-vmxr-562h-rcgg