DSA Study Hub is an interactive educational web application. Prior to commit d527fba, the user authentication system in server/routes/auth.js was found to be vulnerable to Insufficiently Protected Credentials. Authentication tokens (JWTs) were stored in HTTP cookies without cryptographic protection of the payload. This issue has been patched via commit d527fba.

Rejected reason: Further research determined the issue is not a vulnerability.

GitHub, Inc.: AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N

NIST: AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

GitHub, Inc.: CWE-311

GitHub, Inc.: CWE-522

NIST: CWE-522

OR
          *cpe:2.3:a:toxicbishop:dsa_study_hub:*:*:*:*:*:node.js:*:* versions up to (excluding) 2026-02-21

GitHub, Inc.: https://github.com/toxicbishop/DSA-with-tsx/commit/d527fba3b3c15f185b9d1e730322dff9248391e4

GitHub, Inc.: https://github.com/toxicbishop/DSA-with-tsx/security/advisories/GHSA-vmxr-562h-rcgg

GitHub, Inc.: https://github.com/toxicbishop/DSA-with-tsx/commit/d527fba3b3c15f185b9d1e730322dff9248391e4 Types: Patch

GitHub, Inc.: https://github.com/toxicbishop/DSA-with-tsx/security/advisories/GHSA-vmxr-562h-rcgg Types: Vendor Advisory

[{"vendor":"toxicbishop","product":"DSA-with-tsx","versions":[{"version":"< d527fba","status":"affected"}]}]

{"timestamp":"2026-03-09T17:39:45.530637Z","id":"CVE-2026-28678","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}

[{"vendor":"toxicbishop","product":"DSA-with-tsx","versions":[{"version":"< d527fba","status":"affected"}]}]

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

CWE-522

OR
          *cpe:2.3:a:toxicbishop:dsa_study_hub:*:*:*:*:*:node.js:*:* versions up to (excluding) 2026-02-21

GitHub, Inc.: https://github.com/toxicbishop/DSA-with-tsx/commit/d527fba3b3c15f185b9d1e730322dff9248391e4 Types: Patch

GitHub, Inc.: https://github.com/toxicbishop/DSA-with-tsx/security/advisories/GHSA-vmxr-562h-rcgg Types: Vendor Advisory

DSA Study Hub is an interactive educational web application. Prior to commit d527fba, the user authentication system in server/routes/auth.js was found to be vulnerable to Insufficiently Protected Credentials. Authentication tokens (JWTs) were stored in HTTP cookies without cryptographic protection of the payload. This issue has been patched via commit d527fba.

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N

CWE-311

CWE-522

https://github.com/toxicbishop/DSA-with-tsx/commit/d527fba3b3c15f185b9d1e730322dff9248391e4

https://github.com/toxicbishop/DSA-with-tsx/security/advisories/GHSA-vmxr-562h-rcgg