PatchTheCVECVE-2025-56749: Creativeitem Academy LMS up to and including 6.14 uses a hardcoded default JWT secret for token signing
CVE-2025-56749 is a critical-severity flaw (CVSS 9.4) affecting academy lms. Below: why it ranks where it does, which versions are affected, what to do, and the exact commands.
Creativeitem Academy LMS up to and including 6.14 uses a hardcoded default JWT secret for token signing. This predictable secret allows attackers to forge valid JWT tokens, leading to authentication bypass and unauthorized access to any user account.
Why this priority
- Critical severity
- Public exploit reference
- Remotely exploitable, no login, no user action
A fixed release or distro patch exists.
Risk facts
| CVSS score | 9.4 (Critical) |
| Attack vector | Network (remote) |
| Attack complexity | Low |
| Privileges needed | None |
| User interaction | None |
| EPSS exploit chance | 0.5% (top 59%) |
| CISA exploited list | No |
| Weakness | CWE-798 |
| Published | 2025-10-15 |
| Last modified | 2026-06-17 |
Last updated 2026-06-17 · Sources: CVE Program, NVD, CISA KEV, EPSS and vendor advisories · How we score
Am I affected?
Timeline
- Published CVE record published
- Updated Record last modified
Scores and fixes here are computed automatically from those and other public sources. Confirm with the vendor advisory before changing production systems.
Quick answers
How do I fix CVE-2025-56749?
academy lms: upgrade to newer than 6.14. Exact commands for each OS are on this page.
Is CVE-2025-56749 being exploited?
CVE-2025-56749 is not on the CISA Known Exploited Vulnerabilities list at the time of the last update. Check again, as this can change.
What does CVE-2025-56749 affect?
CVE-2025-56749 affects academy lms. Severity is critical (CVSS 9.4). Creativeitem Academy LMS up to and including 6.14 uses a hardcoded default JWT secret for token signing. This predictable secret allows attackers to forge valid JWT tokens, leading to authentication bypass and unauthorized access to any use
How urgent is CVE-2025-56749?
Priority 53/100. Critical severity; Public exploit reference; Remotely exploitable, no login, no user action
Related CVEs
- CVE-2025-71179 MEDIUM 6.1 DOWNGRADE Creativeitem Academy LMS 7.0 contains reflected Cross-Site Scripting (XSS) vulnerabilities via the search para
- CVE-2025-56748 MEDIUM 6.4 UPGRADE Creativeitem Academy LMS up to and including 5.13 uses predictable password reset tokens based on Base64 encod
- CVE-2025-56747 MEDIUM 6.5 UPGRADE Creativeitem Academy LMS up to and including 5.13 contains a privilege escalation vulnerability in the Api_ins
- CVE-2025-56746 LOW 2.2 UPGRADE Creativeitem Academy LMS up to and including 5.13 does not regenerate session IDs upon successful authenticati
- CVE-2024-38959 MEDIUM 6.1 DOWNGRADE Cross Site Scripting vulnerability in Creativeitem Academy LMS Learning Management System v.6.8.1 allows a rem