Executive Summary

CVE-2025-56749 is a critical vulnerability in Creativeitem Academy LMS up to version 6.14 caused by the use of a hardcoded default JWT secret key. This secret key is static and identical across all default installations, allowing attackers to forge valid JWT tokens. By doing so, attackers can bypass authentication and gain unauthorized access to any user account, including administrator accounts. [1]

Useful 0 Not Useful 0

Impact Analysis

This vulnerability allows attackers to completely bypass authentication and escalate privileges by forging JWT tokens. As a result, unauthorized users can access sensitive user data, perform administrative functions, manage courses, and even handle payment processing through the API endpoints that rely on JWT authentication. This can lead to data breaches, loss of control over the system, and potential financial and reputational damage. [1]

Useful 0 Not Useful 0

Detection Guidance

This vulnerability can be detected by checking if the system uses the default hardcoded JWT secret key in the file `lms/application/libraries/TokenHandler.php`. You can inspect this file for the static string "academy-lms-xxxxxxxx" used as the JWT secret. Additionally, you can attempt to forge JWT tokens using the known default secret and verify if they are accepted by the system. For example, using the Python `jwt` library to create a token signed with the default secret and testing if it grants access can confirm the vulnerability. Specific commands include: 1) Searching for the secret in the code: `grep -r "academy-lms-" lms/application/libraries/TokenHandler.php` 2) Using a Python script with the `jwt` library to forge a token and test authentication against the system's API endpoints. [1]

Useful 0 Not Useful 0

Mitigation Strategies

Immediate mitigation steps include changing the JWT secret to a cryptographically secure random value (e.g., a 64-character hex string generated via `random_bytes(32)`), invalidating all existing tokens, and forcing all users to re-authenticate. It is also recommended to store the secret securely in environment variables or configuration files rather than hardcoding it, implement JWT secret rotation, consider using asymmetric signing algorithms like RS256, and enforce proper token expiration policies. [1]

Useful 0 Not Useful 0