{"id":644958,"date":"2026-05-04T10:01:51","date_gmt":"2026-05-04T08:01:51","guid":{"rendered":"https:\/\/mybroadband.co.za\/news\/?p=644958"},"modified":"2026-05-04T10:05:46","modified_gmt":"2026-05-04T08:05:46","slug":"obvious-security-flaw-in-website-of-important-r54-billion-south-african-fund","status":"publish","type":"post","link":"https:\/\/mybroadband.co.za\/news\/security\/644958-obvious-security-flaw-in-website-of-important-r54-billion-south-african-fund.html","title":{"rendered":"Obvious security flaw in website of important R54-billion South African fund"},"content":{"rendered":"\n

The official website for the National Student Financial Aid Scheme (NSFAS) no longer has a valid Transport Layer Security (TLS) certificate, hindering students from accessing the site.<\/p>\n\n\n\n

According to the security details on the website, nsfas.org.za, it expired on Friday, 1 May 2026. Without a valid TLS certificate, communication between users and the web server is unencrypted.<\/p>\n\n\n\n

NSFAS is one of the largest payment facilitators in South Africa, processing monthly payments for over a million beneficiaries. It has a budget of R54 billion for the 2026\/2027 financial year.<\/p>\n\n\n\n

The inability to renew its TLS certificate, a routine security process, points to a larger, systemic problem with the agency’s cybersecurity protocols.<\/p>\n\n\n\n

TLS certificates provide digital validation and encryption of a website’s online identity. They are used to secure connections between user browsers and an organisation’s webpages.<\/p>\n\n\n\n

When certificates expire, connections between browsers and websites are no longer secure, and any sensitive data transmitted may be at risk of interception from threat actors.<\/p>\n\n\n\n

That means data such as login credentials, payment information, or personal details may be exposed and stolen, according to certificate vendor Sectigo.<\/p>\n\n\n\n

“Modern web browsers will display warning messages to users attempting to access a site with an expired security certificate,” the company explained.<\/p>\n\n\n\n

“This can erode users’ trust and deter visitors from continuing to the site, potentially leading to a loss of traffic and credibility.”<\/p>\n\n\n\n

When tested on Monday morning, Google Chrome prevented users from accessing the main NSFAS website. The site was flagged as “untrusted.”<\/p>\n\n\n\n

The my.nsfas.org.za portal appeared to have a valid certificate and remained accessible. This indicated that beneficiaries could still access their accounts without the threat of interception.<\/p>\n\n\n\n

However, any support resources, including student loans, student accommodation, important forms, information on the appeal process and more, are difficult to access due to the expired certificate.<\/p>\n\n\n\n

Users could still access the site by bypassing their browser’s security block via the “advanced options” available on the warning page, but they would do so at their own risk.<\/p>\n\n\n\n

Dr Karen Stander, former chair of the scheme’s board of directors, said in August 2025 that NSFAS’s ICT systems were constantly at risk due to poor security procedures.<\/p>\n\n\n\n

“The organisation’s ICT systems are misaligned with business requirements and lack integration,” she said during a media briefing.<\/p>\n\n\n\n

She said that the scheme’s lacking ICT systems exposed troves of private information from students to “severe cybersecurity risks.”<\/p>\n\n\n\n

In 2024, the Portfolio Committee on Higher Education recommended that NSFAS strengthen its ICT systems<\/a> as a matter of urgency “to curb student data falling into the wrong hands.”<\/p>\n\n\n\n

Tebogo Letsie, chairperson of the committee, said the department must conduct a forensic investigation into the National Treasury funds allocated to the scheme to improve its ICT systems.<\/p>\n\n\n\n

MyBroadband contacted NSFAS upon discovering the expired TLS certificate, but did not receive a response by publication.<\/p>\n\n\n\n

Student discovered security vulnerability at NSFAS<\/h2>\n\n\n\n
\"\"
Jordan Bettridge (left) and Connor Bettridge (right).<\/figcaption><\/figure>\n\n\n\n

In 2025, a Varsity College student discovered a vulnerability<\/a> in the scheme’s ICT systems that, if exploited, would allow attackers to access highly sensitive services.<\/p>\n\n\n\n

The vulnerability could allow attackers to take over an administrative user account with which they could approve or reject funding applications and access sensitive financial information.<\/p>\n\n\n\n

The student, Connor Bettridge, first discovered the vulnerability after he noticed that a panel on the scheme’s web portal displayed every message sent by the system to every user.<\/p>\n\n\n\n

This included one-time PINs (OTPs) that were generated and sent to people who had forgotten their passwords.<\/p>\n\n\n\n

Bettridge continued digging after discovering this flaw and found that the website’s API was extremely poorly secured.<\/p>\n\n\n\n

Bettridge then brought in his older brother, Jordan, to help him investigate for further vulnerabilities. The pair discovered the extent to which an attacker could exploit the NSFAS API.<\/p>\n\n\n\n

They revealed how a threat actor could exploit the API to rapidly download private information from the millions of students who used the system in the past three years.<\/p>\n\n\n\n

A more critical vulnerability discovered by the pair showed how an attacker could use the API to gain administrative access to the NSFAS webpage.<\/p>\n\n\n\n

“NSFAS became aware of a potential security weakness and immediately activated its information security and incident management protocols,” said NSFAS after the vulnerability was reported.<\/p>\n\n\n\n

“The matter was prioritised, investigated, and appropriate remedial actions were implemented without delay.”<\/p>\n\n\n\n

\n\n\n\n

NSFAS website blocking access to students<\/h2>\n\n\n\n
\"\"<\/figure>\n\n\n\n
\"\"<\/figure>\n\n\n\n
\n\n\n\n

Pictured in article thumbnail: Waseem Carrim, Acting Chief Executive Officer of NSFAS<\/em>.<\/p>\n","protected":false},"excerpt":{"rendered":"

An obvious cybersecurity flaw is preventing students from accessing the official NSFAS website, pointing to deeper issues at the scheme. <\/p>\n","protected":false},"author":341213,"featured_media":644959,"comment_status":"open","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"_sma_x_autopost_status":"idle","_sma_x_autopost_error":"","_sma_x_post_id":"","_sma_facebook_post_id":"","_sma_instagram_post_id":"","_sma_threads_post_id":"","_sma_x_attempts":0,"footnotes":""},"categories":[27],"tags":[104983,15227,102674,101213,104982,39608,104984,5106,104100],"class_list":["post-644958","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-security","tag-conner-bettridge","tag-cybersecurity","tag-jordan-bettridge","tag-karen-stander","tag-national-student-financial-aid-scheme","tag-nsfas","tag-tebogo-letsie","tag-tls","tag-tls-certificate"],"_links":{"self":[{"href":"https:\/\/mybroadband.co.za\/news\/wp-json\/wp\/v2\/posts\/644958"}],"collection":[{"href":"https:\/\/mybroadband.co.za\/news\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/mybroadband.co.za\/news\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/mybroadband.co.za\/news\/wp-json\/wp\/v2\/users\/341213"}],"replies":[{"embeddable":true,"href":"https:\/\/mybroadband.co.za\/news\/wp-json\/wp\/v2\/comments?post=644958"}],"version-history":[{"count":10,"href":"https:\/\/mybroadband.co.za\/news\/wp-json\/wp\/v2\/posts\/644958\/revisions"}],"predecessor-version":[{"id":644991,"href":"https:\/\/mybroadband.co.za\/news\/wp-json\/wp\/v2\/posts\/644958\/revisions\/644991"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/mybroadband.co.za\/news\/wp-json\/wp\/v2\/media\/644959"}],"wp:attachment":[{"href":"https:\/\/mybroadband.co.za\/news\/wp-json\/wp\/v2\/media?parent=644958"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/mybroadband.co.za\/news\/wp-json\/wp\/v2\/categories?post=644958"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/mybroadband.co.za\/news\/wp-json\/wp\/v2\/tags?post=644958"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}