{"id":"CVE-2026-63244","kind":"vulnerability","aliases":["CVE-2026-63244"],"related":[],"title":"WizLearn LMS: unauthenticated POST request bypasses login and grants admin","description":"An authentication\nbypass vulnerability in WizLearn Technologies' Learning Management System (LMS)\ncould allow an unauthenticated remote attacker to bypass password\nauthentication and the OAuth authentication flow by sending a specially crafted\nPOST request, potentially resulting in unauthorised access to user accounts and\nfull administrative control of the LMS platform.","summary":"Authentication bypass in the WizLearn LMS social login handler (Google/Facebook OAuth, /wizlearnlms/Login/Login.aspx). A crafted POST skips password and OAuth checks and can give admin access. WizLearn runs the platform itself and has already disabled social login and invalidated all sessions. No customer upgrade is documented.","severity":"critical","cvss":9.8,"epss":0.00536,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["authentication-bypass","lms","oauth","package","saas","self-hosted","vendor","wizlearn"],"not_affected_if":["no-wizlearn-lms","social-login-disabled","unknown"],"how_to_check":"Applies only if you use WizLearn's hosted LMS (lms.wizlearn.com). Nothing to check on your side. Ask WizLearn to confirm remediation and to review admin accounts and audit logs from before 2026-10-05.","fix":"Vendor-side mitigation done 2026-10-05: Google and Facebook social login disabled, all sessions invalidated. Social login stays off until server-side OAuth token verification is implemented. No fixed version published. Use password login and review admin accounts in the meantime.","status":"open","published_at":"2026-10-23T08:16:55+00:00","first_seen_at":"2026-10-23T21:57:32+00:00","triaged_at":"2026-10-23T22:31:33+00:00","updated_at":"2026-10-24T07:15:51+00:00","category":"vendor","confidence":0.75,"triage":{"at":"2026-10-23T22:31:33Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"internet","title":"WizLearn LMS: unauthenticated POST request bypasses login and grants admin","impact":"high","summary":"WizLearn Technologies' Learning Management System lets an unauthenticated remote attacker skip both password login and the OAuth flow with one crafted POST request. The attacker can reach user accounts and gain full administrative control of the LMS.","category":"vendor","who_cares":["lms","wizlearn","self-hosted","saas"],"confidence":0.6,"needs_auth":"no","worst_case":"Attacker gains full admin control of the LMS and user accounts.","analyst_note":"Find the vendor advisory or patched WizLearn LMS version and whether the flaw is in hosted or self-hosted builds; the NVD entry gives no fixed version.","how_to_check":"unknown","needs_analyst":true,"not_affected_if":["unknown"],"user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"critical"},"cost_usd":0.000472,"input_tokens":2964,"output_tokens":352,"severity_before":"critical"},"analyst_status":"done","analyst_note":"Find the vendor advisory or patched WizLearn LMS version and whether the flaw is in hosted or self-hosted builds; the NVD entry gives no fixed version.","search":"'-2026':12A,15A '-63244':13A,16A '/wizlearnlms/login/login.aspx':40B 'access':53B,111C 'account':114C 'admin':10A,52B 'administr':117C 'allow':86C 'alreadi':61B 'attack':90C 'authent':18B,29B,75C,94C,98C 'authentication-bypass':17B 'bypass':6A,19B,30B,76C,92C 'check':48B 'control':118C 'could':85C 'craft':42B,104C 'custom':70B 'cve':11A,14A 'disabl':62B 'document':73B 'flow':99C 'full':116C 'give':51B 'google/facebook':38B 'grant':9A 'handler':37B 'host':26B 'invalid':66B 'learn':81C 'lms':2A,20B,34B,84C,121C 'login':7A,36B,64B 'manag':82C 'oauth':21B,39B,47B,97C 'packag':22B 'password':45B,93C 'platform':57B,122C 'post':4A,43B,105C 'potenti':107C 'remot':89C 'request':5A,106C 'result':108C 'run':55B 'saa':23B 'self':25B 'self-host':24B 'send':101C 'session':68B 'skip':44B 'social':35B,63B 'special':103C 'system':83C 'technolog':80C 'unauthent':3A,88C 'unauthoris':110C 'upgrad':71B 'user':113C 'vendor':27B 'vulner':77C 'wizlearn':1A,28B,33B,54B,79C","nicknames":[],"mitigations":[],"who_affected":null,"tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-23T08:16:55+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","cvss_by":"5f57b9bf-260d-4433-bf07-b6a79e9bb7d4","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-63244","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-63244","severity":null,"published_at":"2026-10-23T08:16:55+00:00","modified_at":"2026-10-23T19:57:42+00:00","first_seen_at":"2026-10-23T21:57:32+00:00","fetched_at":"2026-10-23T22:29:03+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-63244:168","url":null,"severity":null,"published_at":"2026-10-23T22:05:00+00:00","modified_at":"2026-10-23T22:05:00+00:00","first_seen_at":"2026-10-23T22:05:00+00:00","fetched_at":"2026-10-23T22:05:00+00:00","note":"Primary source: CSA Singapore AL-2026-155. Vendor-hosted SaaS (lms.wizlearn.com), flaw in Google/Facebook social login handler /wizlearnlms/Login/Login.aspx (missing server-side OAuth token verification). Vendor mitigated 2026-10-05 server-side; no versions or CVE product ranges published. No exploitation or PoC found; no social discussion searched beyond web results. 'self-hosted' tag looks wrong."},{"source":"analyst","external_id":"CVE-2026-63244:270","url":null,"severity":null,"published_at":"2026-10-23T22:39:19+00:00","modified_at":"2026-10-23T22:39:19+00:00","first_seen_at":"2026-10-23T22:39:19+00:00","fetched_at":"2026-10-23T22:39:19+00:00","note":"No new sources since run 168. Triage re-ran at 22:31 and reset how_to_check, fix, summary and the self-hosted tag; restoring my findings from CSA AL-2026-155: vendor-hosted SaaS, mitigated server-side 2026-10-05, no versions published."},{"source":"epss","external_id":"CVE-2026-63244","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-63244","severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-10-24T07:15:51+00:00","fetched_at":"2026-10-25T12:38:51+00:00","note":null}],"documents":[{"id":1307,"url":"https://www.csa.gov.sg/alerts-and-advisories/alerts/al-2026-155/","title":"CSA Singapore AL-2026-155: WizLearn LMS auth bypass","kind":"advisory","source":"analyst","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}