CVE-2025-56749: Creativeitem Academy LMS up to and including 6.14 uses a hardcoded default JWT secret for token signing. This predictable secret allows attackers to forge…

PriorityP262critical9.4CVSS 3.1

AVNACLPRNUINSUCHIHAL

EPSS

0.45%

35.9th percentile

Creativeitem Academy LMS up to and including 6.14 uses a hardcoded default JWT secret for token signing. This predictable secret allows attackers to forge valid JWT tokens, leading to authentication bypass and unauthorized access to any user account.

Affected

1 ranges

Vendor	Product	Version range	Fixed in
creativeitem	academy_lms	<= 6.14	—

Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.