WizLearn LMS CVE-2026-63244

No special conditions stated - the description indicates a remote, unauthenticated attacker can bypass both password authentication and the OAuth authentication flow by sending a single specially crafted POST request, with no user interaction or prior privileges required (consistent with AV:N/AC:L/PR:N/UI:N). The description does not name a specific feature, configuration setting, or deployment mode as a prerequisite, implying default configurations are affected; however, the exact trigger mechanics of the crafted POST request are not described in the available sources. The main limiting factors are network reachability of the LMS authentication endpoints and the unconfirmed affected-version range (CPE version is a wildcard), so defenders should confirm which releases are vulnerable with the vendor/CSA advisory.

All available signals point to genuine high priority. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N) describes a network-reachable, low-complexity flaw requiring no privileges and no user interaction, and the 9.8 base score is consistent with an authentication bypass that yields full administrative control (C:H/I:H/A:H). The vuln.today decision label is act_now, and the advisory originates from CSA (Cyber Security Agency of Singapore), a national authority, which lends credibility to the severity. Signals that temper urgency: there is no CISA KEV listing, no EPSS probability was supplied, and no public exploit or PoC reference is present, so there is no public exploit identified at time of analysis. The act_now label therefore reflects the critical impact and trivial exploitability of an auth bypass rather than any confirmed in-the-wild activity. Note the CPE uses a wildcard version (affected versions not enumerated), so the exact vulnerable release range is not confirmed from the available data and should be verified against the CSA advisory and vendor.

A remote, unauthenticated attacker sends a specially crafted POST request to the WizLearn LMS login or OAuth endpoint, bypassing both password authentication and the OAuth authentication flow. Because the vector is network-based with low complexity and no privileges or user interaction required, the attacker can authenticate as an arbitrary user and escalate to full administrative control of the platform. No public exploit identified at time of analysis, though the low-complexity nature makes independent exploit development plausible.