CVE-2026-63238

CVE-2026-63238 describes an authentication bypass in Koollab LMS where an unauthenticated attacker can take over any account (including administrator) by supplying a valid user UUID to the 2FA validation endpoint. The connected records reiterate this access path but do not provide version, patch,...

Improper Authentication

Overview Affected versions of this package are vulnerable to Improper Authentication in the twoFactorValidationAction process. An attacker can gain unauthorized access to any 2FA-enabled user account, including administrative accounts, by sending unauthenticated POST requests containing only the...