CVE-2026-28678CRITICAL 9.1EPSS p6.0%

CVE-2026-28678CVE-2026-28678

Description

DSA Study Hub is an interactive educational web application. Prior to commit d527fba, the user authentication system in server/routes/auth.js was found to be vulnerable to Insufficiently Protected Credentials. Authentication tokens (JWTs) were stored in HTTP cookies without cryptographic protection of the payload. This issue has been patched via commit d527fba.

Scoring

CVSS 3.19.1 (CRITICAL)
VectorCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
EPSS0.17% probability of exploitation · percentile 6.0% · 2026-06-19T12:03:05Z
Published2026-03-07
Last modified2026-03-11

Underlying weaknesses· 2

CWE-311CWE-522

References

  1. https://github.com/toxicbishop/DSA-with-tsx/commit/d527fba3b3c15f185b9d1e730322dff9248391e4
  2. https://github.com/toxicbishop/DSA-with-tsx/security/advisories/GHSA-vmxr-562h-rcgg

2

TypeTargetConfidenceTier
WeaknessMissing Encryption of Sensitive Datacwe-3110%live
WeaknessInsufficiently Protected Credentialscwe-5220%live

Related by meaning· 6

Nearest entities by semantic similarity across the cs-graph corpus.

CVE
CVE-2026-36721
CVE
CVE-2026-36727
CVE
CVE-2026-35467
CVE
CVE-2026-8890
CVE
CVE-2025-56749
CVE
CVE-2026-4600
Sourced from NVD + FIRST.org EPSS. Curated for EU compliance use cases by Adam Lundqvist, Founder at SQUR.