External risk intelligence

Creativeitem Academy LMS JWT Secret Vulnerability Allows Authentication Bypass

CVE advisorySeverity: CRITICAL (CVSS 9.4)

CVE-2025-56749

Academy LMS is a web-based learning management system designed to be accessed by students and instructors, typically over the internet. As a web application that facilitates user authentication and account access, it is commonly deployed as an internet-facing service to support remote learning, making it highly probable that the authentication surface is reachable from the public internet.

Authentication Bypass

Creativeitem Academy Lms

6.14 and earlier

Halo Surface Signal: 4 out of 5 — likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

A critical vulnerability has been identified in Creativeitem Academy LMS versions up to 6.14, stemming from a hardcoded default secret used for signing security tokens. This predictable secret allows unauthenticated attackers to forge valid tokens, potentially bypassing security measures and gaining unauthorized access to user accounts.

Predictable secret allows unauthorized account access.
Critical flaw bypasses authentication for any user.
Confirm if your learning platform is affected.

Attack Path

How an attacker could exploit the issue

An attacker can exploit this vulnerability by crafting a malicious JSON Web Token (JWT) since the system uses a predictable, hardcoded secret for signing. This forged token can then be used to impersonate any user, granting the attacker unauthorized access to the system and its data.

Requires network access.
Forges a JWT to bypass authentication.
Unauthorized access and data compromise.

Live Threat

Current exploitation, exposure, and threat context

This vulnerability could allow an unauthenticated attacker to forge authentication tokens, leading to unauthorized access to user accounts and potentially sensitive information within the Academy LMS. The hardcoded default JWT secret makes it possible to bypass authentication when supported by the advisory.

User account access.
Attacker forges JWT tokens.
Unauthorized access to user data.

Operational Fix

Recommended remediation, mitigation, and detection steps

The Creativeitem Academy LMS, up to version 6.14, is vulnerable to authentication bypass due to a hardcoded JWT secret. This allows attackers to forge tokens and gain unauthorized access. Owners of the Academy LMS application and their supporting infrastructure or platform teams should prioritize identifying all instances of this software. The first practical step involves confirming the deployment's reachability and business criticality to accurately assess risk and plan remediation efforts.

Application owners should coordinate remediation.
Verify all Academy LMS instances deployed.
Plan for risk-based maintenance or vendor engagement.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is Creativeitem Academy LMS?

Academy LMS is a web-based learning management system (LMS). Organizations use it to host educational content, manage courses, and provide a digital space for students and instructors to interact. Because it handles user authentication and educational data, it is typically deployed as a web application accessible over the internet to support remote learning.

What does CWE-798 mean for CVE-2025-56749?

CWE-798 refers to the use of hardcoded credentials. In this specific vulnerability, Academy LMS uses a fixed, predictable 'secret' to sign JSON Web Tokens (JWTs). Because the secret is hardcoded into the software rather than being unique to each installation, an attacker can guess or obtain it to create their own valid digital login tokens, effectively bypassing the platform's security check to gain unauthorized access.

How do attackers trigger this JWT vulnerability?

An attacker triggers this issue by crafting a fraudulent JWT and presenting it to the application. Because the system relies on a predictable, hardcoded secret for validation, it accepts the forged token as legitimate. This process does not require any interaction with the actual user or password guessing; it simply exploits the flawed mechanism the application uses to trust incoming connection requests.

Who should prioritize this vulnerability?

Organizations running Academy LMS versions 6.14 or older should prioritize this, especially if the instance is internet-facing. According to Halo Surface Signal, because this software is designed for remote access, these systems are frequently exposed to the public internet, making the authentication surface highly reachable for unauthorized parties to attempt these token forgeries.

Do I need to patch my Academy LMS instance?

You should begin by verifying exactly which instances of Academy LMS are deployed in your environment and confirming their version numbers. Since this is a critical authentication flaw, coordinate with your technical team to assess the business impact of your specific deployment and prepare for authorized remediation steps, such as updates or vendor-provided configuration changes.

References

suryadina.com/academy-lms-jwt-secret-7k9m2x4p8q/

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.