CVE-2026-63244

Summary

An unauthenticated remote attacker can bypass password and OAuth authentication in WizLearn LMS by sending a specially crafted POST request, gaining unauthorized access to user accounts and full administrative control.

Exploitability

Highly exploitable due to lack of authentication requirements and simple request manipulation; no prior access or user interaction needed.

Blast radius

Complete compromise of the LMS platform including data exfiltration, account takeover, and full system control across all users and administrators.

Detection

Look for POST requests to authentication-related endpoints (e.g., /login, /oauth/token) that succeed without valid credentials—specifically, responses returning 200 OK with session tokens or user data despite missing or malformed authentication headers/body. Also monitor for anomalous admin-level API calls from previously unauthenticated sessions.

Prioritized remediation

Upgrade to WizLearn LMS version 2.590 or later, as this is the fixed version specified in the vendor advisory.

Analysis generated locally by garnet-coder (no data left the box). AI-assisted — verify against primary sources before acting.