CVE-2026-28678
dsa-hub-server: Clear-Text Storage of Sensitive Data
Vexday Risk Score
21Bajo
Decisión SSVC (CISA)
Track
Sin señal de explotación → monitorear
CVSS 8.1EPSS 0.2%KEV nãoPoC —Nuclei —Metasploit —Patch —
Ciclo de vida
07 mar 2026Publicada en NVD
Recomendación: Monitorear — sin señal de explotación por ahora.
DSA Study Hub is an interactive educational web application. Prior to commit d527fba, the user authentication system in server/routes/auth.js was found to be vulnerable to Insufficiently Protected Credentials. Authentication tokens (JWTs) were stored in HTTP cookies without cryptographic protection of the payload. This issue has been patched via commit d527fba.
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N
Productos afectados
toxicbishop · DSA-with-tsx¿Quieres saber si tu infraestructura está expuesta a esto?
Hablar con TrueHacking →