CVE-2026-63229

Name of the Vulnerable Software and Affected Versions Koollab LMS (affected versions not specified)

Description A pre-authentication blind SQL injection allows an unauthenticated attacker to use a time-based SQL oracle via the SSO OAuth endpoint to read sensitive database contents. This includes personally identifiable information, credentials, and valid JWT tokens, which may enable account takeover. A time-based SQL oracle is a technique where an attacker infers data by observing the time the server takes to respond to specific queries.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.