CVE-2026-63238: Three Learning Koollab LMS authentication bypass in 2FA endpoint

CVE-2026-63238 · Severity: medium · CVSS 6.5 · Published 2026-07-29

Koollab LMS, a cloud-based learning management system used for corporate training and assessments, contained a flaw that could allow unauthorized individuals to take over any user account. By exploiting a weakness in the two-factor authentication (2FA) process, an attacker could gain full access to student or administrator accounts without knowing their passwords. The vendor has already applied a fix to all cloud-hosted instances, so no action is required by customers.

Technologies: Three Learning Koollab LMS. Vendors: Three Learning.

Quick answers

Is CVE-2026-63238 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-63238 being exploited in the wild.
How severe is CVE-2026-63238?
Medium severity, with a CVSS score of 6.5, published 29 July 2026.
Which products and versions are affected?
Three Learning Koollab LMS 5.3.2.
Is there a fix for CVE-2026-63238?
A patch was published on 2026-04-26: Vendor rolled out fixes to cloud instances Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-63238 attacked?
It is attacked over the network, in a hosted service.
Am I affected by CVE-2026-63238?
Check whether you run Three Learning Koollab LMS at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

An authentication bypass vulnerability exists in the 2FA validation endpoint of Koollab LMS version 5.3.2. The flaw allows an unauthenticated attacker to bypass the primary credential requirement by directly interacting with the two-factor authentication (2FA) validation component. By providing a valid target user's UUID to this endpoint, an attacker can gain full session access to that account, including administrative accounts, without ever providing a password. The vendor, Three Learning, has patched this vulnerability across all cloud-hosted SaaS instances as of April 2026.

Affected products

  • Three Learning Koollab LMS 5.3.2

Timeline

  • 2026-04-14: disclosed: Vulnerability disclosed to vendor
  • 2026-04-26: patched: Vendor rolled out fixes to cloud instances
  • 2026-07-29: advisory: Public advisory released by CSA Singapore and NVD

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.