PlaciPy, a placement management system, assigns a single static default password to every new student account in version 1.0.0. Because the password is hard‑coded, anyone who discovers it can authenticate as any student. This enables a full account takeover, compromising confidentiality, integrity, and potentially availability for all student records and related operations. The weakness is identified as CWE‑259.

Version 1.0.0 of Praskla‑Technology’s assessment‑placipy component is affected. The vulnerability is present in all deployments of that release, regardless of configuration or environment. No later versions are listed as affected.

With a CVSS score of 9.3, the flaw is considered critical. The EPSS score is less than 1%, indicating a low but non‑zero probability of exploitation in the current landscape, and the vulnerability is not listed in CISA’s KEV catalog. Based on the description, the attacker can authenticate as any student via the student portal using the known default password; this attack route is inferred, not explicitly stated. No privileged system access is required, inferred from the nature of the flaw. Because the flaw resides in application logic rather than a misconfiguration, it is trivial to exploit once the target system is reachable.