CVE-2026-63244 Details
Description
An authentication bypass vulnerability in WizLearn Technologies' Learning Management System (LMS) could allow an unauthenticated remote attacker to bypass password authentication and the OAuth authentication flow by sending a specially crafted POST request, potentially resulting in unauthorised access to user accounts and full administrative control of the LMS platform.
An authentication bypass vulnerability has been identified in WizLearn Technologies' Learning Management System (LMS). This vulnerability allows an unauthenticated remote attacker to bypass password authentication and the OAuth authentication flow by sending a specially crafted POST request. Exploitation of this vulnerability could lead to unauthorised access to user accounts and full administrative control of the LMS platform. The issue is present in the social login handler on the WizLearn LMS login page.
WizLearn Technologies has disabled Google and Facebook social login on WizLearn LMS and invalidated all active user sessions as a precautionary measure. The social login functionality will not be re-enabled until secure server-side OAuth token verification has been properly implemented and validated.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Oct 23, 2026CISA-ADP
Assessed Nov 2, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://www.csa.gov.sg/alerts-and-advisories/alerts/al-2026-155 | CSA | AdvisoryRemedy |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-287 | Improper Authentication | CISA-ADP |
Affected Products
| Product | Versions |
|---|---|
| WizLearn LMS | All versions |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Nov 2, 2026 | CVE Modified | CISA-ADP |
| Oct 23, 2026 | New CVE Received | CSA |