An authenticated access control flaw in the SpeedExam Online Examination System enables unauthorized retrieval of sensitive examination answer keys, posing a high risk to assessment integrity.

This is a broken access control vulnerability occurring within the ReviewAnswerDetails ASP.NET PageMethod. Authenticated attackers can invoke this method directly to circumvent client-side restrictions and access unauthorized information.

The exploitation of this vulnerability directly undermines the integrity of online examinations hosted on the SpeedExam platform. With a CVSS score of 8.1, the risk is classified as High because it facilitates the unauthorized disclosure of sensitive testing materials, potentially leading to widespread academic or certification fraud and significant reputational damage to the organization.

Immediate Action: Ensure the organization is utilizing the latest backend service version, as the provider indicates the vulnerability was addressed in the February 2026 backend update.

Proactive Monitoring: Review web server and application access logs for unusual patterns of direct requests to the ReviewAnswerDetails method, particularly from standard user accounts.

Compensating Controls: Implement strict Web Application Firewall (WAF) rules to inspect and block unauthorized or anomalous calls to specific ASP.NET PageMethods originating from non-administrative user sessions.

Public Exploit Available: Yes — a published proof-of-concept exists, attributed to the security researcher's technical write-up linked in the CVE references.

Given the High severity of this access control bypass and the availability of technical details describing the exploit mechanism, organizations relying on SpeedExam should verify their current service version immediately. Administrators must confirm that the February 2026 backend updates have been applied by the SaaS provider to ensure the vulnerability is effectively mitigated.