Loading vulnerability…
Pre-authentication Blind SQL Injection in Koollab LMS SSO OAuth Endpoint
CVE-2026-63229 is a critical pre-authentication blind SQL injection vulnerability affecting Three Learning Koollab LMS version 5.3.2. The flaw is present in the SSO OAuth endpoint, where insufficient neutralization of attacker-controlled input in SQL queries allows unauthenticated remote attackers to trigger a time-based SQL oracle. By issuing crafted requests and inferring database responses from timing differences, an attacker can extract sensitive information from the backend database without needing valid credentials or user interaction. Exposed data may include personally identifiable information, credential material, and valid JWT tokens, creating a path to subsequent unauthorized access and account takeover.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Successful exploitation allows remote unauthenticated disclosure of sensitive database contents. Retrieved information may include personally identifiable information, credentials, and valid JWT tokens. Exposure of authentication material and tokens can enable unauthorized access to user accounts, including potential account takeover, and can compromise both confidentiality and integrity of affected tenant data. No direct availability impact is indicated.
If you can’t patch tonight, do this now.
If immediate confirmation of vendor remediation is not available, restrict exposure to the vulnerable SSO OAuth functionality where operationally feasible, increase monitoring for anomalous requests targeting authentication and SSO-related endpoints, and review for signs of unauthorized database access or token abuse. As a precaution, rotate exposed credentials and invalidate or reissue JWTs and other authentication artifacts that may have been accessible through the vulnerability.
Patch, then assume compromise.
Three Learning rolled out fixes for affected cloud-hosted Koollab LMS instances on 2026-04-26. Because Koollab LMS is delivered as a SaaS application, no customer-side manual patching is required. Affected organizations should ensure their instances are running the vendor-remediated service version and confirm that the provider's fixes have been applied across all hosted environments.
No public exploits tracked yet. Mallory keeps watching.
3 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.