PT-2026-23866 · Unknown · Dsa Study Hub

Toxicbishop · Published 2026-03-07 · Updated 2026-03-12 · CVE-2026-28678

Positive Technologies (AI Summary)

CVSS v3.1

9.1

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

Name of the Vulnerable Software and Affected Versions DSA Study Hub versions prior to commit d527fba

Description The user authentication system in the application’s server/routes/auth.js component had a flaw related to insufficiently protected credentials. Authentication tokens, specifically JWTs, were stored in HTTP cookies without cryptographic protection of the payload. This could potentially allow unauthorized access.

Recommendations Update to commit d527fba or later.

Exploit

Fix

Missing Encryption of Sensitive Data

Insufficiently Protected Credentials

Weakness Enumeration

CWE-311

CWE-522

Related Identifiers

CVE-2026-28678

GHSA-VMXR-562H-RCGG

Affected Products

Dsa Study Hub

References · 11

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/28xxx/CVE-2026-28678.json · Exploit
• https://github.com/toxicbishop/DSA-with-tsx/security/advisories/GHSA-vmxr-562h-rcgg · Vendor Advisory
• https://github.com/toxicbishop/DSA-with-tsx/commit/d527fba3b3c15f185b9d1e730322dff9248391e4 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2026-28678 · Security Note
• https://osv.dev/vulnerability/CVE-2026-28678 · Vendor Advisory
• https://twitter.com/cracbot/status/2032049033867612248 · Twitter Post
• https://t.me/cveNotify/155133 · Telegram Post
• https://t.me/cveNotify/154599 · Telegram Post
• https://twitter.com/VulmonFeeds/status/2030367991775351270 · Twitter Post
• https://twitter.com/TheHackerWire/status/2030584265369596041 · Twitter Post
• https://twitter.com/CVEnew/status/2030339290195279896 · Twitter Post