Exposing Critical Vulnerabilities in CBSE's On-Screen Marking Portal

A cybersecurity researcher discovered critical vulnerabilities in CBSE's On-Screen Marking portal used by thousands of examiners to grade board exams, including a hardcoded master password embedded in publicly accessible JavaScript code that enables authentication bypass and full account takeover. The vulnerabilities, discovered in February 2026 and reported to CERT-In, could allow attackers to tamper with exam grades and compromise the integrity of India's largest national education board's evaluation process. The portal, developed by Coempt EduTeck Pvt Ltd, is also used by multiple other educational institutions, potentially affecting their systems as well.