{"id":"CVE-2026-79575","title":"The JWT signing secret in yfexam-exam v2.0 is derived from the username and the current month instead of a random server-side key, making the secret key easily obtainable via a bruteforce attack.","summary":"The JWT signing secret in yfexam-exam v2.0 is derived from the username and the current month instead of a random server-side key, making the secret key easily obtainable via a bruteforce attack.","severity":"high","cvss":7.5,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","cwe":["CWE-330"],"published":"2026-09-08","updated":"2026-09-09","sourceUpdated":"2026-09-09T16:04:24.933","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-79575","references":[{"url":"https://github.com/fangtang7/CVE/blob/main/yf-exam/JWT.md","label":"cve@mitre.org"},{"url":"https://github.com/fangtang7/CVE/blob/main/yf-exam/JWT.md","label":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"tags":["nvd","cve.org"],"ssvc":{"exploitation":"none","automatable":"yes","technicalImpact":"partial","timestamp":"2026-09-09T14:56:43.210579Z"},"ingestedAt":"2026-09-08T15:33:26.985Z","epss":0.00245,"epssPercentile":0.15991,"slug":"CVE-2026-79575","body":"## Overview\n\nThe JWT signing secret in yfexam-exam v2.0 is derived from the username and the current month instead of a random server-side key, making the secret key easily obtainable via a bruteforce attack.\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"twilight","depthScore":41,"depthScoreParts":{"impact":41.3,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[{"seq":201985,"id":"CVE-2026-79575","ts":1789399993484,"field":"cvss","old":null,"new":"7.5"},{"seq":201984,"id":"CVE-2026-79575","ts":1789399993484,"field":"severity","old":"none","new":"high"},{"seq":200712,"id":"CVE-2026-79575","ts":1789397585555,"field":"cvss","old":"7.5","new":null},{"seq":200711,"id":"CVE-2026-79575","ts":1789397585555,"field":"severity","old":"high","new":"none"},{"seq":199410,"id":"CVE-2026-79575","ts":1789395477734,"field":"cvss","old":null,"new":"7.5"},{"seq":199409,"id":"CVE-2026-79575","ts":1789395477734,"field":"severity","old":"none","new":"high"},{"seq":198655,"id":"CVE-2026-79575","ts":1789392188249,"field":"cvss","old":"7.5","new":null},{"seq":198654,"id":"CVE-2026-79575","ts":1789392188249,"field":"severity","old":"high","new":"none"},{"seq":196986,"id":"CVE-2026-79575","ts":1789384273316,"field":"cvss","old":null,"new":"7.5"},{"seq":196985,"id":"CVE-2026-79575","ts":1789384273316,"field":"severity","old":"none","new":"high"},{"seq":194117,"id":"CVE-2026-79575","ts":1789378694082,"field":"cvss","old":"7.5","new":null},{"seq":194116,"id":"CVE-2026-79575","ts":1789378694082,"field":"severity","old":"high","new":"none"},{"seq":192904,"id":"CVE-2026-79575","ts":1789376494565,"field":"cvss","old":null,"new":"7.5"},{"seq":192903,"id":"CVE-2026-79575","ts":1789376494565,"field":"severity","old":"none","new":"high"},{"seq":191691,"id":"CVE-2026-79575","ts":1789373590440,"field":"cvss","old":"7.5","new":null},{"seq":191690,"id":"CVE-2026-79575","ts":1789373590440,"field":"severity","old":"high","new":"none"},{"seq":190476,"id":"CVE-2026-79575","ts":1789369449700,"field":"cvss","old":null,"new":"7.5"},{"seq":190475,"id":"CVE-2026-79575","ts":1789369449700,"field":"severity","old":"none","new":"high"},{"seq":189263,"id":"CVE-2026-79575","ts":1789368373504,"field":"cvss","old":"7.5","new":null},{"seq":189262,"id":"CVE-2026-79575","ts":1789368373504,"field":"severity","old":"high","new":"none"},{"seq":188046,"id":"CVE-2026-79575","ts":1789365211633,"field":"cvss","old":null,"new":"7.5"},{"seq":188045,"id":"CVE-2026-79575","ts":1789365211633,"field":"severity","old":"none","new":"high"},{"seq":186833,"id":"CVE-2026-79575","ts":1789363455003,"field":"cvss","old":"7.5","new":null},{"seq":186832,"id":"CVE-2026-79575","ts":1789363455003,"field":"severity","old":"high","new":"none"},{"seq":185619,"id":"CVE-2026-79575","ts":1789361195361,"field":"cvss","old":null,"new":"7.5"},{"seq":185618,"id":"CVE-2026-79575","ts":1789361195361,"field":"severity","old":"none","new":"high"},{"seq":184406,"id":"CVE-2026-79575","ts":1789358318993,"field":"cvss","old":"7.5","new":null},{"seq":184405,"id":"CVE-2026-79575","ts":1789358318993,"field":"severity","old":"high","new":"none"},{"seq":182657,"id":"CVE-2026-79575","ts":1789354302699,"field":"cvss","old":null,"new":"7.5"},{"seq":182656,"id":"CVE-2026-79575","ts":1789354302699,"field":"severity","old":"none","new":"high"},{"seq":181450,"id":"CVE-2026-79575","ts":1789353280127,"field":"cvss","old":"7.5","new":null},{"seq":181449,"id":"CVE-2026-79575","ts":1789353280127,"field":"severity","old":"high","new":"none"},{"seq":180243,"id":"CVE-2026-79575","ts":1789350265516,"field":"cvss","old":null,"new":"7.5"},{"seq":180242,"id":"CVE-2026-79575","ts":1789350265516,"field":"severity","old":"none","new":"high"},{"seq":179036,"id":"CVE-2026-79575","ts":1789348257097,"field":"cvss","old":"7.5","new":null},{"seq":179035,"id":"CVE-2026-79575","ts":1789348257097,"field":"severity","old":"high","new":"none"},{"seq":177829,"id":"CVE-2026-79575","ts":1789346356026,"field":"cvss","old":null,"new":"7.5"},{"seq":177828,"id":"CVE-2026-79575","ts":1789346356026,"field":"severity","old":"none","new":"high"},{"seq":176622,"id":"CVE-2026-79575","ts":1789343157307,"field":"cvss","old":"7.5","new":null},{"seq":176621,"id":"CVE-2026-79575","ts":1789343157307,"field":"severity","old":"high","new":"none"},{"seq":174739,"id":"CVE-2026-79575","ts":1789334853179,"field":"cvss","old":null,"new":"7.5"},{"seq":174738,"id":"CVE-2026-79575","ts":1789334853179,"field":"severity","old":"none","new":"high"},{"seq":173534,"id":"CVE-2026-79575","ts":1789333641320,"field":"cvss","old":"7.5","new":null},{"seq":173533,"id":"CVE-2026-79575","ts":1789333641320,"field":"severity","old":"high","new":"none"},{"seq":172348,"id":"CVE-2026-79575","ts":1789331080656,"field":"cvss","old":null,"new":"7.5"},{"seq":172347,"id":"CVE-2026-79575","ts":1789331080656,"field":"severity","old":"none","new":"high"},{"seq":171162,"id":"CVE-2026-79575","ts":1789328750854,"field":"cvss","old":"7.5","new":null},{"seq":171161,"id":"CVE-2026-79575","ts":1789328750854,"field":"severity","old":"high","new":"none"},{"seq":169957,"id":"CVE-2026-79575","ts":1789327144696,"field":"cvss","old":null,"new":"7.5"},{"seq":169956,"id":"CVE-2026-79575","ts":1789327144696,"field":"severity","old":"none","new":"high"}]}