Executive brief
Skillable (formerly Learn on Demand Systems) provides virtual lab environments for technical training and certification. A security flaw in its SCORM integration allows authenticated students to manipulate their user ID during the lab launch process. This can be used to bypass lab usage limits, incur unauthorized costs for the training provider, or consume other students' lab and exam allocations, effectively locking them out of their required coursework.
Technical details
The vulnerability exists in the GET /scorm/launch endpoint at scorm.skillable.com. While the service validates the SCORM session token for authorization, it relies on a client-supplied 'userId' query parameter to enforce per-user launch limits and track allocations without cross-referencing it against the authenticated identity in the token. An attacker with a valid session can perform an Insecure Direct Object Reference (IDOR) style attack by substituting arbitrary userId values. This allows for bypassing per-user rate limits, launching concurrent lab instances, and performing a Denial of Service (DoS) against other learners by exhausting their specific lab or exam allocations. The vendor has stated no fix is planned for the legacy SCORM path and recommends migrating to LTI 1.3 or API-based integrations.
Affected products
- Skillable SCORM Lab Launch Integration through 2026-07-13
Timeline
- 2026-04-28: other: Vulnerability first observed by researcher
- 2026-05-11: other: Report submitted to Skillable product security
- 2026-06-10: other: Vendor responded stating no fix is planned for SCORM path
- 2026-07-12: disclosed: Public disclosure via Openwall oss-security list
- 2026-07-13: advisory: CVE published to NVD