CBSE clarifies after student claims OSM portal hack

Nisarga Adhikary, a 19-year-old ethical hacker, claimed to have found serious vulnerabilities in CBSE's On-Screen Marking portal. CBSE denied any compromise, saying the cited portal was only a testing site and not used for live exam evaluations.

By Harikrishnan R

Hyderabad: A 19-year-old ethical hacker has drawn attention after claiming to have discovered multiple security vulnerabilities in the Central Board of Secondary Education’s (CBSE) On-Screen Marking (OSM) portal, a digital system used for evaluating board examination answer sheets.

---

Nisarga Adhikary, a hobbyist cyber security researcher, said in a blog post on his website that he had identified several flaws in the portal that, according to him, could potentially allow unauthorised access to examiner accounts.

According to Adhikary, the vulnerabilities included a master password embedded in the client-side JavaScript bundle, which he alleged could be used to bypass multi-factor authentication. He also claimed that the system relied on client-side OTP validation, which transmitted the correct OTP to the user’s browser, potentially allowing attackers to intercept it.

He further alleged that the portal had a weak password reset mechanism that allowed users to reset passwords without entering their current passwords.

“Anyone exploiting these could also tamper with or disrupt the grading process, which directly threatens the integrity of the exam evaluations,” Adhikary wrote in his blog post.

Adhikary said he reported the alleged issues to CERT-In in February 2026 and claimed that despite repeated follow-ups, the vulnerabilities remained unresolved for several months.

“It took me less than an hour to find all the vulnerabilities inside the system,” the Class 12 student reportedly said.

However, CBSE rejected suggestions that its live evaluation infrastructure had been compromised. The board clarified that the portal referred to by Adhikary, cbse.onmarks.co.in, was an internal testing site containing sample data and was not the live portal used for evaluating answer sheets.

Following the clarification, Adhikary took to X and disputed the board’s claim by posting screenshots and videos that he said demonstrated the alleged security concerns.

The allegations surfaced amid broader scrutiny surrounding the OSM system and CBSE’s digital evaluation process. In recent weeks, multiple students had raised concerns over answer sheet discrepancies, with some claiming that handwriting in answer sheets uploaded under their roll numbers did not match their own.

The debate also gained momentum following reports that the Class 12 pass percentage had declined to 85.20 per cent this year, while users also reported intermittent portal crashes and technical issues.

Meanwhile, Dharmendra Pradhan has reportedly directed CBSE to strengthen its digital infrastructure and address post-result concerns. He has also asked the board to work with experts to improve transparency and ensure a secure evaluation system.

As the issue continues to attract attention, questions are being raised about the security and reliability of technology-driven assessment systems increasingly used in the education sector.