Nisarga Adhikary's CBSE Vulnerability Report: Unpacking the Digital Security Controversy
In an era where digital transformation is rapidly reshaping educational systems, the integrity and security of online platforms are paramount. The Central Board of Secondary Education (CBSE), India's prominent educational board, recently found itself at the center of a significant cybersecurity controversy. This emerged after a 19-year-old ethical hacker, Nisarga Adhikary, publicly disclosed a series of alleged critical vulnerabilities within the board's newly introduced On-Screen Marking (OSM) portal. This incident has ignited widespread discussions about the robustness of digital evaluation systems and the safety of sensitive student data.
The controversy gained significant traction around May 26-27, 2026, after tech entrepreneur Deedy Das amplified Adhikary's detailed blog post on X, bringing the claims to a broader public audience.
Who is Nisarga Adhikary?
Nisarga Adhikary is a 19-year-old cybersecurity researcher who, remarkably, discovered these vulnerabilities just before appearing for his own Class 12 board exams. Describing himself as a self-taught cybersecurity hobbyist, Adhikary’s meticulous findings and responsible disclosure efforts have positioned him at the forefront of this crucial debate.
The Core Allegations: Alarming Flaws in the OSM Portal
Adhikary's detailed blog post, titled “Exposing Critical Vulnerabilities in CBSE's On-Screen Marking Portal,” outlined several severe loopholes he allegedly found in the system used for digitally evaluating Class 12 board exam papers. The OSM portal was used for the first time this year (2026) to check all CBSE Class 12 papers.
✅ Hardcoded Master Password: A "master password" was allegedly found directly embedded within publicly accessible frontend JavaScript files, capable of bypassing the portal's OTP and authentication flow entirely.
✅ Client-Side OTP Validation: The portal reportedly trusted the user's browser too much, with parts of the authentication logic, including OTP verification, exposed and executed on the client-side rather than being securely verified on CBSE's servers.
✅ Missing Route Protections: Several internal pages and routes within the Angular-based application, such as `/dashboard`, `/profile`, and `/evalscriptsview`, allegedly lacked proper protection, allowing unauthorized access by manipulating browser storage.
✅ Password Reset Flaws: The password reset mechanism reportedly did not verify the old password before allowing a new one, meaning any ValuatorID's password could be reset without proper authorization.
✅ Systemic IDOR Vulnerability: An Insecure Direct Object Reference (IDOR) vulnerability at the architectural level meant the app server trusted client-sent IDs instead of deriving them from authenticated sessions, potentially enabling impersonation of examiners.
The Potential Impact: A Threat to Examination Integrity
The alleged vulnerabilities, if exploited, could have severe repercussions, potentially allowing unauthorized access to examiner accounts, password resets, and even the viewing and modification of students' marks. This raised profound concerns about the sanctity of board exam results, which directly impact students' college admissions and future career opportunities.
Disclosure, Response, and Ongoing Scrutiny
The timeline of events highlights the critical importance of swift and effective cybersecurity responses:
Broader Implications and Student Concerns
This incident unfolds amidst existing criticism and concerns from students regarding the CBSE's digital evaluation system. Students have reported various issues, including mismatches between scanned answer sheets and awarded marks, blurred scans, portal crashes, and evaluation discrepancies. The alleged vulnerabilities further fueled these anxieties, raising questions about the board's digital preparedness and its impact on students' mental well-being and trust in the system.
While CBSE maintains that its live evaluation platform remained secure, the allegations highlight the critical need for stringent security measures and timely patching of vulnerabilities in any system handling sensitive educational data. The incident serves as a crucial reminder for all educational bodies to prioritize cybersecurity in their digital transformation journeys to safeguard student futures and maintain public trust.
