Security Advisory
CVE-2025-56749
9.4
CRITICAL
Vulnerability Description
Creativeitem Academy LMS up to and including 6.14 uses a hardcoded default JWT secret for token signing. This predictable secret allows attackers to forge valid JWT tokens, leading to authentication bypass and unauthorized access to any user account.
Published Date
October 15, 2025
Official Source
NIST NVD Advisory