---
id: "CVE-2026-63244"
kind: "vulnerability"
aliases: ["CVE-2026-63244"]
title: "WizLearn LMS: unauthenticated POST request bypasses login and grants admin"
severity: "critical"
cvss: 9.8
epss: 0.00536
exploited: false
status: "open"
category: "vendor"
products: []
ecosystems: []
tags: ["authentication-bypass", "lms", "oauth", "package", "saas", "self-hosted", "vendor", "wizlearn"]
not_affected_if: ["no-wizlearn-lms", "social-login-disabled", "unknown"]
published_at: "2026-10-23T08:16:55+00:00"
first_seen_at: "2026-10-23T21:57:32+00:00"
updated_at: "2026-10-24T07:15:51+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-63244", "first_seen_at": "2026-10-23T21:57:32+00:00"}, {"source": "analyst", "url": null, "first_seen_at": "2026-10-23T22:05:00+00:00"}, {"source": "analyst", "url": null, "first_seen_at": "2026-10-23T22:39:19+00:00"}, {"source": "epss", "url": "https://api.first.org/data/v1/epss?cve=CVE-2026-63244", "first_seen_at": "2026-10-24T07:15:51+00:00"}]
---

# WizLearn LMS: unauthenticated POST request bypasses login and grants admin

Authentication bypass in the WizLearn LMS social login handler (Google/Facebook OAuth, /wizlearnlms/Login/Login.aspx). A crafted POST skips password and OAuth checks and can give admin access. WizLearn runs the platform itself and has already disabled social login and invalidated all sessions. No customer upgrade is documented.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

Applies only if you use WizLearn's hosted LMS (lms.wizlearn.com). Nothing to check on your side. Ask WizLearn to confirm remediation and to review admin accounts and audit logs from before 2026-10-05.

## Fix

Vendor-side mitigation done 2026-10-05: Google and Facebook social login disabled, all sessions invalidated. Social login stays off until server-side OAuth token verification is implemented. No fixed version published. Use password login and review admin accounts in the meantime.

## Timeline

- 2026-10-23T21:57:32+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-63244
- 2026-10-23T22:05:00+00:00 analyst — Primary source: CSA Singapore AL-2026-155. Vendor-hosted SaaS (lms.wizlearn.com), flaw in Google/Facebook social login handler /wizlearnlms/Login/Login.aspx (missing server-side OAuth token verification). Vendor mitigated 2026-10-05 server-side; no versions or CVE product ranges published. No exploitation or PoC found; no social discussion searched beyond web results. 'self-hosted' tag looks wrong.
- 2026-10-23T22:39:19+00:00 analyst — No new sources since run 168. Triage re-ran at 22:31 and reset how_to_check, fix, summary and the self-hosted tag; restoring my findings from CSA AL-2026-155: vendor-hosted SaaS, mitigated server-side 2026-10-05, no versions published.
- 2026-10-24T07:15:51+00:00 epss https://api.first.org/data/v1/epss?cve=CVE-2026-63244

## Documents

- [advisory] CSA Singapore AL-2026-155: WizLearn LMS auth bypass https://www.csa.gov.sg/alerts-and-advisories/alerts/al-2026-155/

## From the sources

An authentication
bypass vulnerability in WizLearn Technologies' Learning Management System (LMS)
could allow an unauthenticated remote attacker to bypass password
authentication and the OAuth authentication flow by sending a specially crafted
POST request, potentially resulting in unauthorised access to user accounts and
full administrative control of the LMS platform.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_