Executive brief
Johnson & Johnson's Campus Recruiting platform, used to manage student information and interviewer notes during career fairs, contained a security flaw that allowed unauthorized access to sensitive data. An attacker could bypass the login screen by manipulating the website's code, gaining access to the personal details and interview ratings of approximately 1,000 students. This could lead to the exposure of private student information and internal recruitment evaluations.
Technical details
The Johnson & Johnson Campus Recruiting web application suffered from a failure to enforce server-side authorization (CWE-602). While the frontend utilized the Microsoft Authentication Library (MSAL) for user login, the underlying AWS APIs relied on a hardcoded API key rather than validating the MSAL Bearer token. An attacker could bypass the Microsoft SSO redirect by modifying the client-side JavaScript to simulate a successful login state. Once bypassed, the application would use the hardcoded API key to fetch sensitive student data, interviewer notes, and event management details. The issue was resolved by transitioning the API authentication from a static key to Bearer token validation.
Affected products
- Johnson & Johnson Campus Recruiting before 2025-10-31
Timeline
- 2025-10-06: disclosed: Vulnerability reported to Johnson & Johnson's Vulnerability Reporting Program.
- 2025-10-31: patched: Campus Recruiting vulnerability fixed.
- 2026-06-24: advisory: External researcher published technical blog post.
- 2026-06-26: disclosed: CVE-2026-57912 published.