PT-2025-42362 · Creativeitem · Creativeitem Academy Lms

Published 2025-10-15 · Updated 2025-10-15 · CVE-2025-56749

Positive Technologies (AI Summary)

CVSS v3.1

9.4

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L

Name of the Vulnerable Software and Affected Versions Creativeitem Academy LMS versions up to and including 6.14

Description The software uses a hardcoded default JWT secret for token signing. This predictable secret allows attackers to forge valid JWT tokens, leading to authentication bypass and unauthorized access to any user account.

Recommendations Update to a version beyond 6.14.

Exploit

Fix

Using Hardcoded Credentials

Weakness Enumeration

CWE-798

Related Identifiers

CVE-2025-56749

Affected Products

Creativeitem Academy Lms

References · 7

• 🔥 https://suryadina.com/academy-lms-jwt-secret-7k9m2x4p8q · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2025-56749 · Security Note
• https://osv.dev/vulnerability/CVE-2025-56749 · Vendor Advisory
• https://t.me/cveNotify/138784 · Telegram Post
• https://t.me/CVEtracker/35007 · Telegram Post
• https://twitter.com/VulmonFeeds/status/1978543008912957476 · Twitter Post
• https://twitter.com/CVEnew/status/1978562118677835816 · Twitter Post