CBSE Denied an OSM Hack. Its Own Denial Linked the Wrong URL

A 19-year-old cybersecurity hobbyist in West Bengal published a technical breakdown of five vulnerabilities in CBSE’s On-Screen Marking portal, the system used to evaluate Class 12 board-exam answer scripts. The Central Board of Secondary Education rejected the claim. Its denial linked the wrong URL.

Nisarga Adhikary, who sat for his own Class 12 boards this year, says he reported the bugs to the Indian Computer Emergency Response Team (CERT-In, the federal cyber-incident agency) on 25 February 2026, received an acknowledgement reference, and waited. Three months later, with results out and student complaints about blurred scans piling up, he posted screen recordings on his blog. CBSE issued its denial on Tuesday. The URL in the board’s first post carried an inadvertent extra letter and redirected back to Adhikary’s own blog.

The Three-Month Gap Between Disclosure and Denial

Adhikary emailed CERT-In on 25 February, the day after he says he started reading the JavaScript the portal was serving to his browser. CERT-In returned a tracking reference, CERTIn-16590126, in a boilerplate acknowledgement. On his telling, no substantive follow-up arrived, and the vulnerabilities sat live as Class 12 evaluation rolled forward.

By mid-May, students were posting publicly about wrong marks, missing answer-sheet pages, and rechecking delays. Adhikary published his write-up on 22 May. CBSE’s first statement landed on 26 May. The board’s CERT-In responsible-disclosure channel assigns a reference and is expected to coordinate with vendors; the framework publishes no service-level agreement on patch timelines.

What Adhikary Says He Found Inside the Portal

The full technical write-up on the researcher’s blog documents five flaws, each illustrated with a recording. None of them require knowledge of cryptography or server-side exploitation. All of them, on the researcher’s account, are visible in the JavaScript the browser downloads when a user opens the login page.

• Hardcoded master password embedded in the public frontend bundle, which the researcher says bypassed the one-time password (OTP) step entirely.
• OTP values transmitted to the browser for client-side comparison, observable in network traffic before the user enters anything.
• Missing route guards on internal pages, with navigation possible by editing browser storage rather than authenticating.
• An unauthenticated password-reset endpoint that did not verify the user’s current credentials before changing them.
• Systemic Insecure Direct Object Reference (IDOR, where APIs trust a user-controlled ID rather than a server session) across endpoints keyed to a ValuatorID stored in sessionStorage.

Stitched together, those five give a logged-in user the ability to impersonate any examiner, change their bank details, and edit submitted marks. “It took me less than an hour to find all the vulnerabilities inside the system,” Adhikary told The Print in an interview on 26 May. He added, in the same conversation: “You don’t even need to know programming, you just need to know Control F.”

CBSE’s Denial, Then Its Typo

CBSE’s statement, posted on its verified X account, said the URL referenced in Adhikary’s blog, cbse.onmarks.co.in, was a testing environment with sample data, not the production evaluation portal. “There are no actual evaluation data, marks or other data kept on that portal,” the board said, adding that “no security breaches have come to light.”

The Portal used for evaluation of answer-books bore a different URL, which has neither been compromised nor does it have the vulnerabilities indicated in the said social media post.

The board’s own communication created the second problem. Users on X pointed out that cbse.onmarks.co.in (with an inadvertent extra “s”) did not resolve to a CBSE-controlled subdomain at all. It redirected to Adhikary’s blog. CBSE reissued the post with the corrected address, cbse.onmark.co.in. When checked at the time of publication, that page returned a 502 Bad Gateway error from the server stack behind the production system the board was defending.

Coempt EduTeck and the OnMark Footprint

The OnMark platform underneath cbse.onmark.co.in is built and operated by Coempt EduTeck Pvt Ltd, a Hyderabad-based firm previously known as Globarena Technology Pvt Ltd. The same product is sold to the State Council for Technical Education and Vocational Training in Odisha and the State Board of Technical Education and Training in Andhra Pradesh, among other state-level boards.

That matters because the design choices Adhikary describes, particularly the hardcoded credential in the frontend bundle and the trust placed in sessionStorage-supplied IDs, are not specific to the CBSE deployment. They sit in the platform code. If the bugs are real, every educational board using OnMark inherited them.

The vendor’s chief executive, speaking to Newslaundry on 27 May, reportedly characterised the evaluation complaints as limited to “one or two cases.” Coempt EduTeck has previously surfaced in scrutiny of digital evaluation projects, including the 2019 Telangana Intermediate Board results episode that triggered a Telangana High Court inquiry and an order to audit valuation software.

How India’s Responsible Disclosure Pipeline Resolves

CERT-In’s vulnerability-reporting page describes a coordination role: the agency receives the report, assigns a reference, and engages the affected entity. There is no published patch-deadline schedule, no statutory remedy for a researcher whose disclosure is ignored, and no public bug-bounty payout structure operated by the agency itself.

A parallel channel exists at the NCIIPC Responsible Vulnerability Disclosure Programme, but that route covers systems formally designated as Critical Information Infrastructure. School-board evaluation portals, despite handling marks that determine university admission for tens of millions of students, are not on that list.

It’s very disrespectful, to be honest, to not get a response after following up several times.

Adhikary said that to a TV channel, not to the agency. The line is now the one that travels with the story, and it captures what the institutional version of responsible disclosure looks like from the outside: a reference number, a silence, and a denial three months later that points to the wrong address.

After the Denial, a Letter to the Ministry

The Internet Freedom Foundation, a Delhi-based digital-rights group, wrote to the Ministry of Education and CERT-In on 27 May asking for an independent technical audit of OSM, a public timeline of what was reported and when, and a written explanation for why patches were not deployed before evaluation began. The letter ties the security disclosure to the parallel stream of student complaints this cycle about mismatched scans and rechecking errors.

The institutional questions are stacked. Did CERT-In open the ticket and route it to CBSE, and if so, what did CBSE do with it. Did Coempt EduTeck see the report from its government client, and did its other clients in Odisha and Andhra Pradesh receive a heads-up. And if the production portal was genuinely separate from the one Adhikary tested, why does CBSE’s own first denial cite a URL on the same vendor subdomain as the alleged sandbox.

At publication, cbse.onmark.co.in was still returning 502 Bad Gateway. That, for now, is what passes for official confirmation of who is right.