What is the Nisarga Adhikary CBSE OSM portal disclosure?

How a Class 12 student read JavaScript and broke a national exam system

By a CBSE circular dated February 9, 2026, the board announced it was moving Class 12 answer sheet evaluation from physical paper to a digital On-Screen Marking system. Under OSM, physical answer sheets are scanned and uploaded to a portal at cbse.onmark.co.in, where registered examiners log in, mark them on screen, and submit scores. More than 1.8 million students appear for Class 12 examinations, per CBSE’s own enrollment data. Their marks now flow through this portal.

On February 25, 2026, sixteen days after the portal went live, Nisarga Adhikary, a 19-year-old cybersecurity researcher from West Bengal who had just finished his own Class 12 exams, noticed the portal link was public and opened the JavaScript that the browser was downloading. He did not use any hacking tools. He read the code. What he found, and reported to CERT-In the same day, was a portal that could be described without technical exaggeration as having been shipped with the front door unlocked and the key taped to the window.

Why did the CBSE OSM portal have a hardcoded master password in 2026?

Five vulnerabilities. One JavaScript file. Zero server-side validation.

The five vulnerabilities Nisarga found are not sophisticated. They are the kind of flaws that a competent security audit, run before any portal handles 1.8 million students’ marks, would catch in a first pass. That no such audit appears to have been conducted, or that its findings were ignored, is the story underneath the story.

Combined, flaws 01 through 04 enabled what the Internet Freedom Foundation described in its letter as “complete takeover of any examiner account and, by extension, the alteration of marks at scale.” This was not a theoretical risk. The portal was live. Examiners were actively marking answer sheets.

What did CERT-In and CBSE say about the Nisarga Adhikary disclosure?

Boilerplate email. 90 days. A student blog goes viral. Then the Ministry steps in.

CERT-In, India’s national cybersecurity response body under the Ministry of Electronics and Information Technology, received Nisarga’s full disclosure on February 25, 2026. Per the IFF account of events, CERT-In acknowledged receipt with a boilerplate email and then went silent. No patch confirmation. No communication. No public advisory. For nearly three months, the vulnerabilities remained unpatched. Class 12 evaluation, scheduled under CBSE’s February 9 circular, proceeded on the same portal during this window.

On May 22, 2026, Nisarga published his findings on his personal blog and shared them on X. Tech entrepreneur Deedy Das amplified the post, and it went viral within hours. CBSE has not publicly confirmed or denied any breach. The Education Ministry has since announced it will oversee CBSE Class 12 evaluation. IIT experts and public sector banks have been called in to audit the OSM system. That it took a teenager’s blog post to trigger government action that CERT-In’s disclosure process should have triggered three months earlier is the failure the IFF letter puts on record. As TNT News Buzz documented in the NEET refund portal activation case in May, India’s examination system has a documented pattern of digital infrastructure failures meeting institutional silence.

Timeline: from disclosure to public crisis

What does this mean for CBSE Class 12 students: 2026 guide

One vendor. Multiple boards. One set of flaws. Zero public audit.

The most consequential fact in this story is one that every other outlet has mentioned in passing and none has pursued: Coempt EduTeck’s OnMark platform is not exclusively used by CBSE. Nisarga’s own blog post confirms the same platform is deployed across multiple boards and institutions. If the CBSE instance of OnMark shipped a hardcoded master password in its public JavaScript, the question is not only whether CBSE’s marks were at risk. The question is which other board’s marks ran through the same codebase, and whether those instances carry the same class of vulnerabilities.

IFF’s letter demands a review of CBSE’s contract with Coempt EduTeck. It does not appear to have demanded an audit of every other institution using OnMark. That gap is where 90 days of CERT-In silence leaves the country: knowing a private vendor shipped a broken product to a national examination board, while the same vendor continues to serve other boards, with no public audit, no mandatory disclosure, and no statutory deadline forcing CERT-In to respond. The specific question that neither CBSE, CERT-In, nor the Ministry of Education has answered: who approved Coempt EduTeck’s OnMark platform for national examination use, what security testing was required before that approval, and who signed off on the contract?