CVE-2026-63229

Pre-authentication blind SQL injection vulnerability

Critical · published July 29, 2026

CVSS v3.1
9.1
EPSS
1%
Percentile
43.5
In the wild
Unconfirmed
What it is

A pre-authentication blind SQL injection

vulnerability in Koollab LMS allowed an unauthenticated attacker to use a time-based SQL oracle via

the SSO OAuth endpoint to read sensitive database contents, including

personally identifiable information, credentials, and valid JWT tokens that may

enable account takeover.

The record
Technical detail
CVSS v3.1
9.1 · CRITICAL
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
CVSS v4.0
Not supplied
EPSS
0.00522 · 43.5th percentile
Published
2026-07-29T06:09Z
EPSS history
Timeline
  • 29 JUL 06:09Z
    Pre-authentication blind SQL injection vulnerability
    cvelistv5