CVE-2026-28678

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-28678
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-28678.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-28678
Aliases
  • GHSA-vmxr-562h-rcgg
Published
2026-03-07T16:06:51.072Z
Modified
2026-04-02T13:22:22.783657Z
Severity
  • 8.1 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N CVSS Calculator
Summary
dsa-hub-server: Clear-Text Storage of Sensitive Data
Details

DSA Study Hub is an interactive educational web application. Prior to commit d527fba, the user authentication system in server/routes/auth.js was found to be vulnerable to Insufficiently Protected Credentials. Authentication tokens (JWTs) were stored in HTTP cookies without cryptographic protection of the payload. This issue has been patched via commit d527fba.

Database specific 
{
    "cwe_ids": [
        "CWE-311",
        "CWE-522"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/28xxx/CVE-2026-28678.json",
    "cna_assigner": "GitHub_M"
}
References

Affected packages

Git / github.com/toxicbishop/dsa-with-tsx

Affected ranges

Type
GIT
Repo
https://github.com/toxicbishop/dsa-with-tsx
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
d527fba3b3c15f185b9d1e730322dff9248391e4

Affected versions

v1.*
v1.0

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-28678.json"
unresolved_ranges 
[
    {
        "events": [
            {
                "introduced": "0"
            },
            {
                "fixed": "2026-02-21"
            }
        ]
    }
]