Executive brief
Totara LMS, a learning management system used for corporate training and compliance, contains a vulnerability in its login interface. An attacker can manipulate the login page to reveal a hidden local login form, bypassing standard Single Sign-On (SSO) protections like Okta. If successful, this allows an attacker to attempt to guess user passwords without the usual security restrictions, potentially leading to unauthorized access to sensitive employee data and corporate training records.
Technical details
Totara LMS v19.1.5 and earlier is vulnerable to an Incorrect Access Control flaw in the login component. By manipulating client-side code on the login page, an attacker can reveal a hidden local login form, which reportedly allows for the bypass of configured SSO providers (such as Okta). Furthermore, the local login form lacks sufficient rate-limiting, enabling unauthenticated remote attackers to perform brute-force credential stuffing attacks. The vendor disputes this vulnerability, claiming that local login status is enforced server-side and cannot be enabled via client-side manipulation. Security researchers recommend upgrading to versions beyond 19.1.5.
Affected products
- Totara Totara LMS <= 19.1.5
Timeline
- 2026-04-13: disclosed: Initial disclosure and CVE assignment
- 2026-05-06: other: Vendor disputed the vulnerability findings