![\"Days](\"https:\/\/static.toiimg.com\/thumb\/msid-131648480,imgsize-35764,width-400,height-225,resizemode-4\/1280720-2026-06-11t092018350.jpg\" "\\".\\"")
<\/div>\n<\/div>\n<\/div>\n<\/section>\n<\/div><\/div>\n<\/div>\nDays after making headlines over his claims of security vulnerabilities in CBSE’s digital systems, 19-year-old ethical hacker Nisarga Adhikary has joined IIT Kanpur’s cybersecurity innovation hub.Adhikary was appointed as an Open-Source Intelligence (OSINT) and Threat Intelligence Engineer at C3iHub, the technology innovation hub at IIT Kanpur. His LinkedIn profile states that he is currently working in OSINT and threat intelligence at the institute.The appointment comes shortly after Adhikary drew national attention with a series of allegations related to CBSE’s digital infrastructure.In posts on X, Adhikary claimed that scanned answer sheets and question papers linked to CBSE were publicly accessible because of an alleged cloud storage configuration issue. He alleged that an AWS storage bucket containing 2026 answer sheets and question papers could be accessed without authentication.“Anyone on the internet can download any scanned booklet,” he wrote in one of the posts.Adhikary had earlier also claimed to have found vulnerabilities in CBSE’s On-Screen Marking (OSM) portal. In a blog post, he said he had discovered the issues in February and reported them to CERT-In before making them public.According to his claims, some of the vulnerabilities could have allowed unauthorised access to parts of the evaluation system. The allegations quickly gained attention on social media, with several users raising concerns about data security and student privacy.According to the blog, the alleged vulnerabilities included a \u201chardcoded master password\u201d visible inside the portal\u2019s JavaScript bundle, client-side OTP validation, missing route protections, password reset flaws and what he described as a \u201csystemic IDOR vulnerability\u201d.\u201cOne of the hardest things was not exploitation,\u201d he wrote, \u201cThe hardest part was reading a JavaScript file and editing a couple of values in DevTools.\u201d Adhikary also alleged that OTP verification was effectively meaningless because \u201cthe browser grades its own test\u201d.\u201cA security control that runs on the attacker\u2019s machine isn\u2019t a control at all,\u201d he wrote.<\/div>\n<\/div>\n