IIT Kanpur hires teen who exposed CBSE portal loopholes

Kanpur: Nineteen-year-old ethical hacker Nisarg Adhikari, who exposed serious security flaws in the Central Board of Secondary Education’s (CBSE) official Online Submission of Marks (OSM) portal, has secured a position at the Indian Institute of Technology (IIT) Kanpur.

Adhikari has been appointed as an Open-Source Intelligence (OSINT) and Threat Intelligence Engineer at C3iHub, IIT Kanpur’s cybersecurity innovation hub. The appointment has been confirmed by IIT Kanpur Director Manindra Agrawal and has also been reflected on Adhikari’s professional profile.

The teenager, who recently appeared for his Class 12 examinations and is awaiting results, came into the national spotlight after identifying major vulnerabilities in the OSM portal used by CBSE-affiliated schools across the country to upload student marks. According to his findings, the flaws could have exposed highly sensitive information belonging to students and teachers. The loopholes allegedly made it possible to alter critical records, including personal details, roll numbers and even banking information linked to teachers.

When Adhikari first disclosed the vulnerabilities, CBSE rejected the claims and maintained that there had been no breach of data security. Adhikari later stated that despite formally informing the authorities about the issue, his warnings were initially ignored.

His work, however, drew the attention of cybersecurity experts at IIT Kanpur, who assessed the significance of the vulnerabilities he had uncovered and the technical expertise involved in identifying them. The institution subsequently recruited him to its research and innovation ecosystem focused on cybersecurity and threat intelligence.

The appointment marks a significant step in Adhikari’s transition from student researcher to cybersecurity professional. His recruitment has attracted attention in technology and academic circles, with many highlighting it as an example of how independent cybersecurity research and responsible vulnerability disclosure can lead to professional opportunities and recognition.

Tags: