Education system under threat? Questions raised over CBSE marking system after glitch found

A 19-year-old boy identifying as a cybersecurity researcher has claimed that the test website of the Central Board of Secondary Education’s (CBSE) On-Screen Marking (OSM) contained a hard-coded “master password” that could reportedly be used to surpass OTP verification, log into examiner accounts and also change the marks of students.

The allegations were raised by Nisarga Adhikary, who told Hindustan Times that he identified the suspected vulnerability while reviewing the backend code of the OSM test website introduced this year for Class 12 board exams. However, the Central Board of Secondary Education clarified that the main evaluation portal had not been breached, stating that the issues pointed out by the teenager were limited to a testing platform containing only sample data.

The issue gained wider attention after a Delhi student, Vedant Shrivastava, claimed that the Physics answer sheet uploaded under his roll number did not belong to him. His posts on social media quickly went viral, following which CBSE reportedly admitted in an email reviewed by Hindustan Times that a technical glitch had resulted in the upload of an incorrectly scanned answer sheet.

Similarly, a Class 12 student identified as Sanjana has also claimed that her Chemistry answer sheet has exploded across social media. In a clip on X, she is seen holding her evaluated paper and pointing out what she claims are glaring discrepancies in marking.

Embedded ‘Master password' in code

Adhikary claimed that the portal's frontend JavaScript bundle reportedly contained a “literal password string” embedded directly in the code. He added that after going through the authentication flow, he discovered that the password could bypass security checks, directly opening the evaluation dashboard.

“I started examining the special logic for username, password, and OTPs and how it's processed. When examining that, I found a master password,” he told Hindustan Times. “After a bit of reading the code, I saw that the master password can bypass all the security protocols and open the dashboard directly.”

The teenager alleged that by using an examiner’s user ID and school code, details he claimed were publicly accessible, it was possible to access examiner accounts without completing the OTP authentication step.

Nisarga Adhikary further claimed that the level of access was broad enough to permit modifications to answer-sheet evaluations as well as examiner-related information. He alleged that once logged into an examiner’s account, a user could edit answer sheets, access examiner details, and perform other actions on the portal.

He also stated that he was able to enter evaluation dashboards and make changes linked to examiner profiles, including altering personal and banking information. When asked about the potential risks, Adhikary claimed that such a vulnerability could have been misused by malicious actors to manipulate marks and obtain sensitive data. “He or she could have extracted data on a large scale and sell them on the black market. He or she would have tampered with marks, changed the marks of people as they want to,” he claimed.

Adhikary also accused the process of having flaws in the OTP system, password-reset process and access controls inside the portal. “So anyone could enter any rubbish thing in the old password thing and use anyone's user ID and put a new password to take over their account, which was really insecure, in my opinion,” he said.

He also alleged that several internal dashboards were accessible without adequate security protections. According to Nisarga Adhikary, multiple broken access-control vulnerabilities allegedly allowed users to access or view sections and information they were not authorised to see.

CBSE denied any allegations

However, the Central Board of Secondary Education (CBSE) denied allegations that its active evaluation system had been breached. The board clarified that the portal used for evaluating answer sheets operated on a separate URL, which, according to CBSE, was neither compromised nor affected by the vulnerabilities mentioned in the social media posts.

In response to it, Union Education Minister Dharmendra Pradhan addressed the controversy and claimed to take responsibility, assuring students and parents that "no one will be spared" if irregularities are found in the evaluation process. "I take responsibility. It will be fixed, and a solution will be found. We are all working on that task," he said.