CVE-2026-28678 Details
Description
Rejected reason: Further research determined the issue is not a vulnerability.
A vulnerability allowing insufficiently protected credentials has been identified in the DSA Study Hub application. This issue arises from the user authentication system, where JSON Web Tokens (JWTs) are stored in HTTP cookies without proper cryptographic protection. The vulnerability exists in versions prior to 1.0. Tokens were transmitted and stored in a base64-encoded plaintext format, leaving them exposed to interception and manipulation. Although the cookies had the 'httpOnly' flag, this did not prevent the JWT payload from being accessed in an unprotected manner.
The vulnerability has been patched in version 1.0 by implementing a symmetric encryption layer for the JWT cookies. The 'encrypt' and 'decrypt' functions, using AES-256-GCM, are now applied to the tokens before they are stored in client-side cookies, ensuring the confidentiality of the token payload.
Metrics
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No CVSS 3.x data is available for this CVE.
No data available for CVSS Version 2.0 on this CVE.
No SSVC data is available for this CVE.
References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
No references are available for this CVE.
Weakness Enumeration
No weakness enumeration is available for this CVE.
Affected Products
No affected product data is available for this CVE.
Change History
6 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 30, 2026 | CVE Rejected | [email protected] |
| Jun 30, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| Mar 11, 2026 | Initial Analysis | [email protected] |
| Mar 7, 2026 | New CVE Received | [email protected] |