EUVD-2026-21930
GHSA-2969-3f7h-gmhq
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
Lifecycle Timeline
6DescriptionCVE.org
Totara LMS v19.1.5 and before is vulnerable to Incorrect Access Control. The login page code can be manipulated to reveal the login form. An attacker can chain that with missing rate-limit on the login form to launch a brute force attack.
AnalysisAI
Brute-force authentication bypass in Totara LMS versions 19.1.5 and earlier allows unauthenticated remote attackers to compromise user accounts via credential stuffing. The vulnerability chains login page manipulation with missing rate-limiting controls, enabling automated password guessing attacks. With CVSS 9.8 (critical) severity but only 0.02% EPSS probability (5th percentile), this represents a high-severity design flaw with currently low observed exploitation activity. A proof-of-concept exploit exists on GitHub (saykino/CVE-2026-31282), lowering the barrier for attack automation, though no confirmed active exploitation (CISA KEV) has been reported.
Technical ContextAI
Totara LMS is a learning management system based on Moodle architecture. This vulnerability represents CWE-284 (Improper Access Control) where the application fails to implement defense-in-depth controls on authentication mechanisms. The attack surface consists of two chained weaknesses: first, the login page code can be manipulated to expose the authentication form (suggesting client-side controls or DOM manipulation vulnerabilities), and second, the absence of server-side rate-limiting on login attempts. The CVSS vector (AV:N/AC:L/PR:N/UI:N) indicates this is a network-accessible vulnerability with low attack complexity requiring no privileges or user interaction, making it highly automatable. Modern authentication systems should implement multiple controls including CAPTCHA mechanisms, exponential backoff, account lockouts, and IP-based rate limiting to prevent credential stuffing and brute-force attacks. The CPE string indicates incomplete product identification data, though the vulnerability clearly affects Totara LMS products up to version 19.1.5.
RemediationAI
Organizations running Totara LMS should immediately upgrade to a patched version beyond 19.1.5, though specific fixed version details are not provided in available vendor advisories at totara.com. Until patches can be applied, implement compensating controls including web application firewall rules to enforce aggressive rate-limiting on authentication endpoints (recommended: maximum 5 failed attempts per IP per 15-minute window), deploy CAPTCHA or similar challenge-response mechanisms on login forms, implement account lockout policies after repeated failed attempts, enable multi-factor authentication for all user accounts, restrict network access to Totara LMS instances using IP allowlisting where feasible, and monitor authentication logs for brute-force patterns. Review GitHub repository saykino/CVE-2026-31282 for proof-of-concept details to inform detection rule development. Consult VulDB advisory 357168 and official Totara security bulletins for additional mitigation guidance and confirmed patch availability timelines.
LibreNMS before 24.10.0 allows a remote attacker to execute arbitrary code via OS command injection involving AboutContr
Reachable assertion in Open5GS up to version 2.7.6 allows remote unauthenticated attackers to crash the Diameter CER han
A Command Injection issue in the payload build page in BYOB (Build Your Own Botnet) 2.0 allows attackers to execute arbi
Denial of service in Open5GS 2.7.6 and earlier allows network-adjacent attackers with low-privilege Diameter Gx peer acc
Denial of service in Open5GS HSS (Home Subscriber Server) versions 2.7.0 through 2.7.6 is triggered remotely by manipula
Remote command injection in Control Web Panel allows unauthenticated attackers to execute arbitrary OS commands as root
LINQPad before 5.52.01 Pro edition is vulnerable to Unsafe Deserialization in LINQPad.AutoRefManager::PopulateFromCache(
Remote code execution in dash-uploader (Python package for Plotly Dash) versions 0.1.0 through 0.7.0a2 allows unauthenti
Command injection in LiteLLM 1.18.10 lets attackers who can configure MCP (Model Context Protocol) servers supply arbitr
SQL injection in AzuraCast's backup restore flow (versions up to and including 0.23.7) lets an attacker achieve privileg
Arbitrary file read in Yu AI Code Mother v4.3 lets anonymous, remote attackers retrieve files outside the intended previ
Remote code execution in APScheduler (all versions through 3.10.x and 4.0.0a5) is achievable when applications deseriali
Same weakness CWE-284 – Improper Access Control
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today