| Package | Affected versions | Patched versions |
|---|---|---|
| academy lms | ≤ 6.14 |
Creativeitem Academy LMS up to and including 6.14 uses a hardcoded default JWT secret for token signing. This predictable secret allows attackers to forge valid JWT tokens, leading to authentication bypass and unauthorized access to any user account.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free