WizLearn Technologies Learning Management System: Authentication bypass (CVE-2026-63244)
WizLearn Technologies' Learning Management System (LMS) is vulnerable to an authentication bypass via specially crafted POST requests, allowing unauthenticated attackers to gain administrative access.
CVE search metadata
CVE search record: CVE-2026-63244. Severity: critical. CVSS: 9.8. KEV: no. Product: Learning Management System. Brief: WizLearn Technologies Learning Management System: Authentication bypass (CVE-2026-63244). Brief link: https://feed.craftedsignal.io/briefs/2026-10-wizlearn-lms-auth-bypass/
Triage facts
Revision 1- Applicability
- Learning Management System
- Evidence
- Unknown
- Severity
- Critical
- Action
- Immediate escalation
- Sources
- 1 public source
- Freshness
- Revision 1Oct 23, 08:41 UTC
- Vulnerabilities
- 1 CVE
- Source quality
- A1Likely
CVE-2026-63244 identifies an authentication bypass vulnerability within the WizLearn Technologies Learning Management System (LMS). An unauthenticated remote attacker can circumvent password authentication and OAuth flows by sending a specially crafted POST request. This vulnerability can lead to unauthorized access to user accounts and full administrative compromise of the LMS platform.
Impact
Successful exploitation allows unauthenticated remote attackers to obtain administrative privileges, potentially resulting in full system compromise, access to sensitive user data, and the ability to manage the learning environment without authorized credentials.
Recommendation
- Inventory all instances of WizLearn LMS deployed within the network.
- Prioritize the application of vendor-supplied patches for CVE-2026-63244 once available.
- Implement strict network access controls (e.g., VPN or IP whitelisting) for the LMS administrative interface to mitigate unauthorized access attempts until patches are deployed.
- Review web server access logs for anomalous, high-frequency POST requests to authentication or OAuth-related endpoints.
Immediate actions
Inventory all WizLearn LMS installations.
Threat Hunt
Hunt for anomalous or unauthorized POST requests to authentication and OAuth callback endpoints in LMS web server logs.
Data: Web server logs (POST method, request paths associated with auth/OAuth)
Mitigations
Restrict external access to LMS authentication endpoints via firewall or WAF rules.
CVE-2026-63244