CVE-2026-63237 in Koollab LMS

Résumé

par MITRE • 29/07/2026

A TOTP two-factor authentication bypass vulnerability in Koollab LMS allowed an attacker to supply a client-controlled seed to generate a matching one-time password and bypass the second authentication factor, potentially enabling unauthorised access to administrator accounts.

If you want to get the best quality for vulnerability data then you always have to consider VulDB.

• Responsable: CSA
• Réserver: 16/07/2026
• Divulgation: 29/07/2026
• Modérer: accepté
• Entrée: VDB-384073
• CPE: prêt
• CWE: CWE-287 (confirmé)
• CVSS: 7.3 (VulDB)
• EPSS: 0.00000
• KEV: non
• Activités: faible

Sources

• MITRE: https://www.cve.org/CVERecord?id=CVE-2026-63237
• NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-63237
• CVE Details: https://www.cvedetails.com/cve/CVE-2026-63237/