Breaches and incidents
CBSE (India): On-Screen Marking portal flaws (master password in JavaScript, OTP returned to browser) during board evaluation
Bengaluru researcher Nisarga Adhikary reported five critical flaws in CBSE’s OnMark On-Screen Marking portal.
- Disclosed
- Verification
- Confirmed by two or more outlets
What happened
- Bengaluru researcher Nisarga Adhikary reported five critical flaws in CBSE’s OnMark On-Screen Marking portal: a hard-coded master password in front-end JavaScript (independently verified by Karan Saini from an archived January 2026 bundle), the OTP sent back to the browser and checked client-side, internal pages reachable without login, password reset without server-side check of the old password, and examiner impersonation via an ID in sessionStorage (MediaNama). He reported to CERT-In shortly after 25 Feb 2026 and got only a templated acknowledgement.
- Root cause: authentication and authorisation enforced in the client.
- Attacker: none known; researcher disclosure. Vendor reported as a Hyderabad firm.
- Response: CBSE first said the tested URL “is the testing site only with sample data” (27 May; Pranesh Prakash noted the denial named a different domain registered minutes earlier); on 31 May CBSE said “The identified vulnerabilities have been contained” and deployed experts from government agencies and IITs; Education Minister Dharmendra Pradhan acknowledged discrepancies.