Executive brief
SpeedExam is a cloud-based platform used for conducting online tests and certifications. A security flaw in the system allows authenticated test-takers to bypass intended restrictions and access the full answer key for an exam before or during the test. This undermines the integrity of the examination process and could lead to widespread cheating or unauthorized certification.
Technical details
A broken access control vulnerability exists in the SpeedExam SaaS platform due to the insecure exposure of ASP.NET AJAX PageMethods. Specifically, the 'ReviewAnswerDetails' method in the code-behind does not properly validate authorization on the server side. An authenticated attacker (e.g., a candidate) can bypass client-side UI restrictions and invoke this WebMethod directly via JavaScript or manual HTTP requests. This allows the attacker to perform an Insecure Direct Object Reference (IDOR) attack to retrieve the complete answer key (flags) for an exam. The vendor addressed this via a backend service update in February 2026.
Affected products
- SpeedExam Online Examination System (SaaS) after v.FEV2026
Timeline
- 2026-02: patched: Fixed in backend service update
- 2026-03-17: disclosed: Initial NVD publication