Is CVE-2026-63238 being exploited?

No public exploit is currently tracked.

How severe is CVE-2026-63238?

CVE-2026-63238 has a CVSS v3 severity of MEDIUM (6.5).

Back

CVE-2026-63238

Description

An authentication bypass vulnerability in Koollab LMS allowed an unauthenticated attacker to take over any account, including administrator accounts, by supplying a valid user UUID without providing primary credentials via the 2FA validation endpoint.