CVE-2025-56749
📋 TL;DR
This vulnerability allows attackers to forge valid JWT authentication tokens using a predictable hardcoded secret, enabling complete authentication bypass. Any Creativeitem Academy LMS installation up to version 6.14 is affected, allowing unauthorized access to any user account including administrators.
💻 Affected Systems
- Creativeitem Academy LMS
📦 What is this software?
Academy Lms by Creativeitem
⚠️ Risk & Real-World Impact
Worst Case
Complete system compromise where attackers gain administrative access, modify course content, steal student data, and potentially pivot to other systems.
Likely Case
Attackers gain unauthorized access to user accounts, potentially accessing sensitive student information, modifying grades, or disrupting learning activities.
If Mitigated
With proper network segmentation and monitoring, impact is limited to the LMS system itself, though authentication bypass still enables unauthorized access.
🎯 Exploit Status
Exploitation requires only knowledge of the hardcoded secret and basic JWT manipulation skills.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Version 6.15 or later
Vendor Advisory: https://suryadina.com/academy-lms-jwt-secret-7k9m2x4p8q/
Restart Required: Yes
Instructions:
1. Backup your current installation. 2. Download and install version 6.15 or later from the official source. 3. Restart the web server. 4. Verify the JWT secret has been regenerated.
🔧 Temporary Workarounds
Manual JWT Secret Regeneration
linuxManually generate and set a strong random JWT secret in the configuration
php artisan jwt:secret
php artisan config:clear
🧯 If You Can't Patch
- Implement network-level controls to restrict LMS access to trusted IPs only
- Enable detailed authentication logging and monitor for suspicious JWT token usage
🔍 How to Verify
Check if Vulnerable:
Check if JWT_SECRET in .env file matches known hardcoded default values or if version is 6.14 or earlierCheck Version:
Check composer.json or version file in installation directoryVerify Fix Applied:
Verify JWT_SECRET has been changed to a strong random value and version is 6.15+📡 Detection & Monitoring
Log Indicators:
- Multiple failed login attempts followed by successful authentication with unusual patterns
- JWT tokens with suspicious claims or timestamps
Network Indicators:
- Unusual authentication requests from unexpected IP addresses
- Multiple authentication attempts in short timeframes
SIEM Query:
source="academy-lms-logs" AND (event="authentication" AND result="success") | stats count by user, src_ip | where count > threshold