CVE-2026-63238

—

CVSS 3.1

6.5 medium

EPSS

<1%p12

Published

Jul 29, 2026 (Jul 29, 2026)

Modified

Jul 30, 2026

Description

An authentication bypass vulnerability in Koollab LMS allowed an unauthenticated attacker to take over any account, including administrator accounts, by supplying a valid user UUID without providing primary credentials via the 2FA validation endpoint.

Weakness: CWE-287
Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:N

NVD CVE.org GitHub PoCs EPSS (0.2%)

In the news0 stories

No ingested article mentions this CVE yet.