CVE-2026-63237 TOTP two-factor authentication bypass vulnerability
Attackers can bypass TOTP two-factor authentication by supplying a client-controlled seed, potentially gaining unauthorized administrator access to Koollab LMS.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-63237?
CVE-2026-63237 is a medium-severity authentication bypass vulnerability in Three Learning Koollab LMS, published on 29 Jul 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
A TOTP two-factor authentication bypass vulnerability in Koollab LMS allowed an attacker to supply a client-controlled seed to generate a matching one-time password and bypass the second authentication factor, potentially enabling unauthorised access to administrator accounts.
Weakness: CWE-347
Which versions are affected by CVE-2026-63237?
How do I fix CVE-2026-63237?
No fix has been published for CVE-2026-63237 yet. Limit exposure of the affected software until one is available.
Upgrade, and rotate credentials and sessions that may have been exposed. More about Authentication bypass.
Is CVE-2026-63237 being exploited?
There is no known exploitation of CVE-2026-63237 in the wild and no public exploit code.
Sources
Also known as GHSA-8j44-5653-q846.