CVE-2025-56749: Critical severity Creativeitem Academy LMS vulnerability
Creativeitem Academy LMS up to and including 6.14 uses a hardcoded default JWT secret for token signing. This predictable secret allows attackers to forge valid JWT tokens, leading to authentication bypass and unauthorized access to any user account.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2025-56749?
CVE-2025-56749 is rated as critical due to its potential for authentication bypass and unauthorized access.
How do I fix CVE-2025-56749?
To fix CVE-2025-56749, update Academy LMS to a version newer than 6.14 where the hardcoded JWT secret issue is resolved.
What impact does CVE-2025-56749 have?
CVE-2025-56749 allows attackers to forge valid JWT tokens, leading to unauthorized access to user accounts.
Which versions of Creativeitem Academy LMS are affected by CVE-2025-56749?
Creativeitem Academy LMS versions up to and including 6.14 are affected by CVE-2025-56749.
Is there a workaround for CVE-2025-56749?
Currently, the only effective solution for CVE-2025-56749 is to upgrade to a patched version of Academy LMS.