CVE-2026-63231

Name of the Vulnerable Software and Affected Versions Koollab LMS (affected versions not specified)

Description A post-authentication SQL injection allows an authenticated attacker to use an error-based SQL oracle via the face-to-face runs update endpoint to read the entire application database and obtain valid JWT (JSON Web Tokens) for account takeover. An error-based SQL oracle is a technique where the attacker uses database error messages to extract data from the system.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.