CBSE denies OSM portal breach; claims evaluation facility has ‘different URL’

In response to security concerns raised by 19-year-old student and ethical hacker Nisarga Adhikary, the Central Board of Secondary Education (CBSE) has clarified breached site, cbse.onmark.co.in, is an internal testing platform and not the actual OSM evaluation portal. The Class 12 student claimed that he was able to bypass parts of the CBSE OSM portal’s login and access-control systems.

Adhikary posted a thread on X and a detailed blog post claiming that he was able to bypass parts of the CBSE OSM portal’s security measures . He also said that issues were reported privately to CERT-In, India’s cybersecurity response agency, months back.

The student’s post quickly went viral on social media, with cybersecurity professionals, students, and educators questioning the transparency of the national-level exam system. CBSE introduced on-screen marking from this year onwards, and all CBSE Class 12 papers were checked on that portal.

Also read CBSE third language policy throws French, Spanish, German teachers across schools into crisis

CBSE's Clarification: Nisarga Adhikary vulnerabilities report

According to CBSE's post on X, "cbse.onmarks.co.in" is an internal testing site with sample data for review purposes, and no actual evaluation data, marks, or other data have been added to that portal.

"There are no actual evaluation data, marks or other data held on that portal. The Board emphasises that no security breaches have come to light on the Portal deployed for the actual evaluation work," CBSE said in a post on X.

However, following the CBSE's statement, Adhikary rejected the board's claim that the affected systems were used only for internal testing, claiming that he has proof of CERT-In acknowledgements.

Also read CBSE third language policy throws French, Spanish, German teachers across schools into crisis

"If this was test data – how I was able to log in with prod user data completely? I have a screen recording of it and proof of CERT-In acknowledging it," the student said in a recent post on X.

Adhikary further alleged that multiple domains under onmark – cbse1.onmark.co.in, cbse2.onmark.co.in, cbse3.onmark.co.in and cbse4.onmark.co.in – showed the same vulnerabilities.

Also read ‘People called us anti-national’: CBSE student says board sends correct answer sheet after social media outcry

Additionally, CBSE has received 4,04,319 applications from students seeking scanned copies of evaluated answer scripts. More than 11.31 lakh students have requested answer books for the Class 12 examinations. Till now, 8,98,214 answer books have already been furnished to students. The CBSE board said that the remaining pending requests are expected to be fulfilled by May 27.

CBSE answer sheet mismatch chaos

A CBSE Class 12 student, Vedant, alleged on social media that the handwriting in the scanned physics answer sheet uploaded under his roll number did not match his own, raising concerns about whether his actual answer sheet had been evaluated.

Several other students also expressed their concerns after obtaining photocopies of their answer sheets through CBSE’s revaluation portal. Class 12 students demanded re-evaluation of their marks, alleging a discrepancy in the overall aggregate score.

Later, CBSE admitted the mismatch in answer scripts of students and assured that the correct answer sheets would be shared with students at their registered email addresses.

Notably, in response to the concerns raised by parents and students regarding CBSE OSM re-evaluation portal technical glitches, Union education minister Dharmendra Pradhan announced that technical experts from the Indian Institute of Technology (IIT) Madras and IIT Kanpur would support CBSE in improving and strengthening the portal infrastructure.