A critical vulnerability in yfexam-exam v2.0 allows unauthenticated attackers to forge JWT tokens by brute-forcing a predictable signing secret.

The application utilizes an insecure method for generating JWT signing secrets, which are derived from user-controlled usernames and the current month. This design flaw allows unauthenticated remote attackers to determine the secret key through brute-force methods.

The ability to forge valid JWT tokens grants an attacker the capability to impersonate any user, including administrative accounts, leading to full unauthorized access to application data and functionality. With a CVSS score of 7.5, this high-severity vulnerability represents a significant risk to the confidentiality and integrity of the system, potentially resulting in complete data exposure and loss of trust.

Immediate Action: Since a specific patch version is currently unavailable, administrators should immediately isolate the affected instance from public networks or implement strict access controls to prevent unauthorized interaction.

Proactive Monitoring: Monitor authentication logs for an unusual volume of login attempts or anomalous token validation failures that may indicate brute-force activity against the JWT signing mechanism.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to detect and block high-frequency requests or suspicious patterns targeting the authentication endpoint.

Public Exploit Available: Unknown.

Given the high severity of this authentication bypass, organizations running yfexam-exam v2.0 must treat this as a priority. Administrators should restrict access to the application immediately and communicate with the vendor to obtain a secure update that implements cryptographically secure, server-side random key generation for JWT signing.