CVE-2026-28678 - Vulnerability Analysis

Overview

DSA Study Hub contains an insufficiently protected credentials vulnerability caused by storing JWT authentication tokens in HTTP cookies without cryptographic payload protection, letting attackers potentially access sensitive authentication data, exploit requires interception of cookies.

Severity & Score

Impact

Attackers can access authentication tokens, potentially leading to account compromise or unauthorized access.

Mitigation

Update to the version including commit d527fba or later.

References

• https://github.com/toxicbishop/DSA-with-tsx/commit/d527fba3b3c15f185b9d1e730322dff9248391e4
• https://github.com/toxicbishop/DSA-with-tsx/security/advisories/GHSA-vmxr-562h-rcgg

Social Media Activity(1 post)

TheHackerWire

@thehackerwire

Mar 8, 2026

🟠 CVE-2026-28678 - High (8.1) DSA Study Hub is an interactive educational web application. Prior to commit d527fba, the user authentication system in server/routes/auth.js was found to be vulnerable to Insufficiently Protected Credentials. Authentication tokens (JWTs) were sto... 🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-28678/ #CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

View original post

Related Resources

• Vulnerability Intelligence Dashboard
• Credential Scanner