The Tech Crisis Deepens: CBSE Takes a Major U-Turn, Admits Critical Flaws After Gen-Z Whistleblowers Sound the Alarm

Just days after flatly denying any security compromises, the Central Board of Secondary Education (CBSE) has officially reversed its stance. On Sunday, May 31, 2026, the board admitted that major vulnerabilities did indeed exist within its digital evaluation infrastructure.

The security crisis escalated rapidly from what CBSE initially brushed off as a "testing site rumor" into a full-scale cybersecurity fire drill, drawing intervention from elite government tech bodies and the Indian Institutes of Technology (IITs).

From "Fake News" to National Security Intervention

The controversy began when 19-year-old ethical hacker Nisarga Adhikary published a detailed technical breakdown exposing how CBSE’s newly rolled out On-Screen Marking (OSM) portal was virtually left wide open.

While the board initially claimed the screenshots were merely from an internal testing URL filled with mock data, Adhikary countered with video proof showing a completely exposed "master password" hardcoded into the portal's frontend JavaScript bundle. This allowed him to bypass the OTP authentication layer entirely, view examiner details, and access what appeared to be live production data.

Things got even worse when another student whistleblower, 17-year-old Sarthak Sidhant, dropped a second bombshell blog post. Sidhant exposed that an administrative portal could be accessed with the astonishingly weak password 123456, and alleged that an AWS cloud bucket containing 2026 answer sheets and question papers was entirely unauthenticated—meaning anyone with the link could list, paginate, and download millions of student booklets.

What Left the Gate Wide Open?

The technical oversights flagged by the teen researchers read like a textbook list of "what not to do" in modern web development:

Hardcoded Master Credentials: A master password was visible in plain text inside the portal’s public JavaScript files.

Client-Side OTP Validation: The browser was effectively grading its own security test. Instead of the server verifying the OTP, the app checked it client-side, allowing anyone to open Developer Tools and manually force the app to skip the login screen.

Insanely Insecure Cloud Storage: Missing AWS bucket permissions meant the ListObjectsV2 command required zero authentication, exposing entire file directories of scanned student answer booklets.

Broken Password Resets: The "change password" API allowed user accounts to be overtaken simply by passing a User ID and a new password, without requiring the original password.

CBSE's Damage Control Mode

Following immense public outcry and pressure from political leaders, CBSE posted an official update on X acknowledging the security gaps and thanking the ethical hackers for highlighting the weaknesses.

"We have been closely monitoring the vulnerabilities in the OnMark portal of our service provider that are being flagged in the public domain. An expert team of cybersecurity professionals has been deployed over the last few days from across various arms of the government as well as the IITs to fortify these systems, including taking them over to a more secure setup."

— CBSE Official Statement  

The board confirmed that the identified vulnerabilities have since been contained, and they are moving the infrastructure over to a heavily fortified system to rule out further exploitable bugs.

Following the board’s public acknowledgment and the deployment of government cybersecurity forces, Adhikary posted on social media that his "work was done" and he had stopped testing the system, signaling a temporary truce in what has become one of India’s most high-profile student-led tech cleanups.

You can watch a detailed video report about the initial controversy surrounding the hack on the India Today News Report, which breaks down the specific technical claims made by the teenage researcher before the board's official U-turn.