Was CBSE’s OSM portal hacked? Here’s what a 19-year-old’s claims reveal; board denies security breach

The ongoing controversy surrounding the Central Board of Secondary Education’s On-Screen Marking (OSM) system has taken another turn after a 19-year-old ‘cybersecurity enthusiast’ alleged that he had discovered and reported multiple vulnerabilities in the CBSE’s evaluation portal months before the recent issue emerged.

The allegations surfaced through a viral post on X and a subsequent detailed blog post published on May 22, where the individual claimed he had “hacked” the OSM portal in February 2026 and reported the issues to CERT-In, the Indian Computer Emergency Response Team.

However, the CBSE has denied claims that its actual evaluation portal was compromised, stating that the URL mentioned in the allegations was that of a testing site containing sample data and not the live platform used for evaluating answer sheets.

The fresh allegations come at a time when trust in the CBSE’s OSM system is already under scrutiny following complaints from students regarding a myriad of issues like unexpectedly low marks, blurry scanned copies, missing pages, unchecked answers, answer sheet mismatches, and technical glitches on the re-evaluation portal.

What the 'hacker' alleged

In his initial social media post, Nisarga, a 19-year-old who called himself a hobbyist cybersecurity researcher, said, “I had hacked CBSE’s OSM (On-Screen Marking Portal) in February and had reported the vulnerabilities to CERT-In, but they were unable to patch most of them.”

He also published a lengthy technical blog post describing what he alleged were multiple vulnerabilities in the platform used for digital evaluation of answer sheets.

According to the blog post, the alleged issues included:

• A “hardcoded master password” allegedly visible inside publicly accessible JavaScript files

• OTP validation allegedly happening entirely on the client side

• Weak route protection

• Password reset vulnerabilities

• Systemic IDOR (Insecure Direct Object Reference) issues that allegedly allowed user impersonation

The blogger alleged that someone with basic technical knowledge could potentially bypass authentication, access examiner accounts, reset passwords, and potentially interfere with evaluation-related workflows.

The individual also claimed that the portal contained references to real evaluator dashboards and production-linked systems.

He further alleged that the vulnerabilities were first discovered on February 25 and were reported to CERT-In before being publicly disclosed.

'Vulnerabilities remained unpatched'

In his blog, Nisarga repeatedly argued that such vulnerabilities could threaten the integrity of large-scale board examination evaluations if left unresolved.

“Anyone exploiting these could also tamper with or disrupt the grading process,” the post claimed.

The writer also alleged that many of the vulnerabilities remained unaddressed for weeks despite being reported.

The post quickly gained traction online, particularly because it emerged amid the larger controversy surrounding the CBSE’s newly implemented OSM system.

CBSE denies compromise

In response to the allegations, the CBSE issued a clarification denying that its actual evaluation portal had been compromised

According to the board, the URL referenced in the social media posts and blog was only a testing site used for internal review purposes.

“At the outset, it is clarified that the Portal used for evaluation of answer-books bore a different URL, which has neither been compromised nor does it have the vulnerabilities indicated in the said social media post,” the CBSE stated.

The board further said, “The URL cbse.onmark.co.in is the testing site only with sample data for internal testing and review purposes. There are no actual evaluation data, marks or other data held on that portal.”

It also maintained that no security breach had been detected in the platform actually used for evaluation work.

“The Board emphasises that no security breaches have come to light on the Portal deployed for the actual evaluation work," it added.

The board further defended the OSM system, stating that it had been introduced to improve transparency and included “strong safeguards” and grievance redressal mechanisms.

Hacker comes back with more ‘proof’

Following the CBSE’s denial, the individual posted another series of messages on X disputing the board’s claims.

In the posts, he alleged that archived versions of the portal still contained the vulnerabilities he had described earlier. He also shared videos and references to archived snapshots, claiming they showed the same master password and related code structures.

He further claimed that some vulnerabilities remained visible in archived code even after the issues were reported.

The latest development adds to the growing scrutiny surrounding the CBSE’s OSM system, which was fully implemented for 2026 Class 12 board examinations.

Amid the growing criticism, the Union Education Ministry has already deployed experts from Indian Institute of Technology Madras and Indian Institute of Technology Kanpur to audit the technical infrastructure supporting the OSM-related re-evaluation portal and post-result processes.