{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-28678", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "REJECTED", "assignerShortName": "GitHub_M", "dateReserved": "2026-03-02T21:43:19.927Z", "datePublished": "2026-03-07T16:06:51.072Z", "dateUpdated": "2026-06-30T18:36:40.195Z", "dateRejected": "2026-06-30T18:36:40.195Z"}, "containers": {"cna": {"rejectedReasons": [{"lang": "en", "value": "Further research determined the issue is not a vulnerability."}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-06-30T18:36:40.195Z"}}}}

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-28678", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "REJECTED", "assignerShortName": "GitHub_M", "dateReserved": "2026-03-02T21:43:19.927Z", "datePublished": "2026-03-07T16:06:51.072Z", "dateUpdated": "2026-06-30T18:36:40.195Z", "dateRejected": "2026-06-30T18:36:40.195Z"}, "containers": {"cna": {"rejectedReasons": [{"lang": "en", "value": "Further research determined the issue is not a vulnerability."}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-06-30T18:36:40.195Z"}}}}

{"cveTags": [], "descriptions": [{"lang": "en", "value": "Rejected reason: Further research determined the issue is not a vulnerability."}], "id": "CVE-2026-28678", "lastModified": "2026-06-30T19:16:28.153", "metrics": {}, "published": "2026-03-07T16:15:54.010", "references": [], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Rejected"}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[0,d527fba)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "cna", "scores": [{"score": 100.0, "source": "cna"}]}, "original": {"product": "DSA-with-tsx", "source": "cna", "vendor": "toxicbishop"}, "product": "dsa-with-tsx", "vendor": "toxicbishop"}], "analysis": {"en": {"generated_at": "2026-04-17T12:09:12.310830+00:00", "value": {"mitigation_remediation": ["Update the application to commit d527fba3b3c15f185b9d1e730322dff9248391e4, which fixes the cookie storage logic.", "Configure authentication cookies with the HTTPOnly and Secure flags and enforce HTTPS for all connections.", "Ensure that JSON Web Tokens are signed with a strong algorithm and that the payload is encrypted or contains minimal sensitive data."], "summary": {"action": "Immediate patch", "impact": "Credential theft via clear-text token storage"}, "threat_synthesis": {"affected_systems": "The affected application is toxicbishop DSA-with-tsx, a Node.js\u2011based educational web service. Any deployment of the application prior to commit d527fba3b3c15f185b9d1e730322dff9248391e4 is vulnerable. Versions that have not applied the patch that changed the cookie handling logic are at risk.", "description_and_impact": "Anonymous or authenticated users could steal authentication cookies because the server stores JSON Web Tokens without cryptographic protection of the payload. The vulnerability is an instance of insufficiently protected credentials, allowing an attacker to obtain a valid token and impersonate a user, thereby compromising confidentiality of user accounts and any data accessed under that session.", "risk_and_exploitability": "The vulnerability scores a CVSS of 8.1, indicating high potential impact. However, the EPSS score of less than 1% suggests a very low probability of active exploitation at the time of this analysis, and the issue is not listed in the CISA KEV catalog. An attacker would generally need to acquire the cookie through network sniffing, cross\u2011site scripting, or other client\u2011side manipulation, and then use the unprotected JWT to authenticate as a legitimate user. The exploit path is inferred from the nature of the flaw; no additional remediation is required beyond the official patch."}}}}, "created": "2026-03-09T10:05:04.753217+00:00", "updated": "2026-04-17T12:15:18.167275+00:00", "vendors": ["toxicbishop", "toxicbishop$PRODUCT$dsa-with-tsx"]}