19-year-old ethical hacker Nisarg Adhikary hired by IIT Kanpur after exposing CBSE security flaws

Nisarg Adhikary, who completed his Class 12 exams this year, gained national attention after publishing a blog post on May 22 detailing five critical vulnerabilities in CBSE's On-Screen Marking portal, including a master password stored in plain text, client-side OTP validation, missing route protections, password reset flaws, and a systemic IDOR vulnerability. He had first reported the issues to India's cybersecurity watchdog CERT-In in February, but only one vulnerability was patched before the portal was taken down. IIT Kanpur director Manindra Agrawal, who was stationed at CBSE headquarters as part of a government-directed review team, met Adhikary in Delhi and subsequently offered him the role. Adhikary also separately alleged that an AWS storage bucket containing 2026 CBSE answer sheets and question papers was publicly accessible without authentication. His appointment at C3iHub is on a contractual basis, and while he described the salary as decent, he noted it was lower than expected given his prior experience working with US-based companies. Adhikary, who began coding at age six and started participating in Capture the Flag competitions in Class 6, said he does not plan to enroll in college and is focused on building startups and products. The broader CBSE OSM controversy has also drawn public protests, with student groups demonstrating against the system's rollout.