CVE-2026-79575

High severity, CVSS 7.5. EPSS: 0.4% chance of exploitation in the next 30 days.

The JWT signing secret in yfexam-exam v2.0 is derived from the username and the current month instead of a random server-side key, making the secret key easily obtainable via a bruteforce attack.

Published 2026-09-08. Last modified 2026-09-09.