Loading vulnerability…
Authentication Bypass in Koollab LMS 2FA Validation Endpoint
CVE-2026-63238 is an authentication bypass vulnerability in Koollab LMS 5.3.2 affecting the two-factor authentication validation flow. The flaw allows an unauthenticated attacker to complete account takeover by submitting a valid user UUID to the 2FA validation endpoint without first successfully completing primary authentication. Because the endpoint accepts the user identifier as sufficient proof of authentication state, the application can bind the attacker to the targeted account, including privileged administrator accounts.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Successful exploitation enables unauthenticated takeover of arbitrary user accounts, including administrator accounts. This can result in full compromise of affected accounts, unauthorized access to application data and functionality, privilege abuse through administrative interfaces, and follow-on actions such as modifying content, accessing sensitive user information, or using the compromised account as a foothold for broader platform abuse.
If you can’t patch tonight, do this now.
Where immediate code remediation is not possible, restrict access to the affected authentication workflow, monitor for anomalous 2FA validation activity, and review authentication logs for attempts involving mismatched or unexpected user identifiers. Additional defensive measures include enforcing strong session binding between primary authentication and second-factor validation, invalidating suspicious sessions, and rotating credentials for potentially affected accounts, especially administrative users.
Patch, then assume compromise.
Three Learning rolled out fixes for affected cloud-hosted Koollab LMS instances on 2026-04-26. Remediation requires correcting the authentication flow so that the 2FA validation endpoint only accepts requests tied to a previously verified primary-authentication session or transaction, and ensuring that user-supplied identifiers alone cannot satisfy authentication requirements. Because Koollab LMS is delivered as a SaaS application, no customer-side patching is reported as necessary.
No public exploits tracked yet. Mallory keeps watching.
1 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.