CVE-2026-63237: Three Learning Koollab LMS TOTP 2FA bypass

CVE-2026-63237 · Severity: medium · CVSS 4.8 · Published 2026-07-29

Koollab LMS, a cloud-based learning management system, was found to have a security flaw in its two-factor authentication (2FA) process. An attacker could potentially bypass the secondary security layer by providing their own security 'seed' to generate a valid login code. If successful, this could allow unauthorized access to user accounts, including those with administrative privileges, compromising sensitive training data and system settings.

Technologies: Three Learning Koollab LMS. Vendors: Three Learning.

Quick answers

Is CVE-2026-63237 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-63237 being exploited in the wild.
How severe is CVE-2026-63237?
Medium severity, with a CVSS score of 4.8, published 29 July 2026.
Which products and versions are affected?
Three Learning Koollab LMS 5.3.2.
Is there a fix for CVE-2026-63237?
A patch was published on 2026-04-26: Vendor rolled out fixes to cloud-hosted instances Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-63237 attacked?
It is attacked over the network, in a hosted service.
Am I affected by CVE-2026-63237?
Check whether you run Three Learning Koollab LMS at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A vulnerability in the Time-based One-Time Password (TOTP) implementation of Koollab LMS allowed for a 2FA bypass. The flaw stems from the application permitting a client-controlled seed to be supplied during the authentication process. By providing a known seed, an attacker can generate the corresponding valid TOTP token, effectively neutralizing the second factor of authentication. This could lead to unauthorized access to administrator accounts if the primary credentials are also compromised or bypassed. The vendor has patched this vulnerability across its SaaS infrastructure.

Affected products

  • Three Learning Koollab LMS 5.3.2

Timeline

  • 2026-04-14: disclosed: Vendor disclosure
  • 2026-04-26: patched: Vendor rolled out fixes to cloud-hosted instances
  • 2026-07-29: advisory: Public release of advisory

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.