{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/vendors/wizlearn-technologies/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:wizlearn:learning_management_system:*:*:*:*:*:*:*:*"],"_cs_cves":[{"cvss":9.8,"id":"CVE-2026-63244"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["Learning Management System"],"_cs_severities":["critical"],"_cs_tags":["web-application","authentication-bypass","cve-2026-63244"],"_cs_type":"advisory","_cs_vendors":["WizLearn Technologies"],"content_html":"\u003cp\u003eCVE-2026-63244 identifies an authentication bypass vulnerability within the WizLearn Technologies Learning Management System (LMS). An unauthenticated remote attacker can circumvent password authentication and OAuth flows by sending a specially crafted POST request. This vulnerability can lead to unauthorized access to user accounts and full administrative compromise of the LMS platform.\u003c/p\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation allows unauthenticated remote attackers to obtain administrative privileges, potentially resulting in full system compromise, access to sensitive user data, and the ability to manage the learning environment without authorized credentials.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003col\u003e\n\u003cli\u003eInventory all instances of WizLearn LMS deployed within the network.\u003c/li\u003e\n\u003cli\u003ePrioritize the application of vendor-supplied patches for CVE-2026-63244 once available.\u003c/li\u003e\n\u003cli\u003eImplement strict network access controls (e.g., VPN or IP whitelisting) for the LMS administrative interface to mitigate unauthorized access attempts until patches are deployed.\u003c/li\u003e\n\u003cli\u003eReview web server access logs for anomalous, high-frequency POST requests to authentication or OAuth-related endpoints.\u003c/li\u003e\n\u003c/ol\u003e\n","date_modified":"2026-10-23T08:41:49Z","date_published":"2026-10-23T08:41:49Z","id":"https://feed.craftedsignal.io/briefs/2026-10-wizlearn-lms-auth-bypass/","summary":"WizLearn Technologies' Learning Management System (LMS) is vulnerable to an authentication bypass via specially crafted POST requests, allowing unauthenticated attackers to gain administrative access.","title":"WizLearn Technologies Learning Management System: Authentication bypass (CVE-2026-63244)","url":"https://feed.craftedsignal.io/briefs/2026-10-wizlearn-lms-auth-bypass/"}],"language":"en","title":"CraftedSignal Threat Feed - WizLearn Technologies","version":"https://jsonfeed.org/version/1.1"}