Executive brief
This entry was originally reported as a security flaw in DSA Study Hub, an educational web application, but has since been rejected by researchers. The initial report suggested that user login tokens were stored insecurely in web cookies, potentially allowing unauthorized access. However, further investigation determined that the implementation does not constitute a security vulnerability, and the CVE has been withdrawn.
Technical details
Originally reported as a vulnerability in the user authentication system (server/routes/auth.js) of DSA Study Hub, this CVE was rejected after further research. The initial concern involved JSON Web Tokens (JWTs) being stored in HTTP cookies without cryptographic protection of the payload (CWE-311/CWE-522). While a patch was initially issued in commit d527fba, the security community later determined the behavior did not meet the criteria for a vulnerability. The CVE is now marked as Rejected.
Affected products
- toxicbishop DSA Study Hub (DSA-with-tsx) versions prior to commit d527fba
Timeline
- 2026-03-07: disclosed: Initial disclosure of the reported issue
- 2026-03-11: advisory: NIST initial analysis published
- 2026-06-30: other: CVE officially rejected after further research determined it was not a vulnerability