Exposing Critical Vulnerabilities in CBSE’s On-Screen Marking Portal: From Authentication Bypass to Full Account Takeover

I first posted a rough write-up of these vulnerabilities to r/CBSE using a throwaway reddit account, but I figured a proper write-up on my own blog would be a better home for it. The tweet (X post) where this is being discussed can be found here . These vulnerabilities were initially discovered on 25 February 2026 and were promptly reported to CERT-In. What is CBSE and On-Screen Marking? The…