External risk intelligence

Koollab LMS Pre-Authentication SQL Injection via SSO OAuth

CVE advisorySeverity: CRITICAL (CVSS 9.1)

CVE-2026-63229

The vulnerability exists in an SSO OAuth endpoint within a learning management system. SSO and authentication portals are designed to be public-facing to facilitate user login and identity federation, making them natively internet-accessible in standard deployments.

SQL Injection

Halo Surface Signal: 5 out of 5 — more likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

This advisory details a critical vulnerability in Koollab's Learning Management System that could allow an unauthenticated attacker to access sensitive database information, including personal data, credentials, and authentication tokens, potentially leading to account takeover. The issue is related to how the system handles single sign-on authentication.

Unauthenticated attackers can steal sensitive data.
Affects user credentials and account access.
Confirm relevance and exposure of Koollab LMS.

Attack Path

How an attacker could exploit the issue

An attacker could exploit this vulnerability by sending specially crafted requests to the Single Sign-On (SSO) OAuth endpoint of the Koollab LMS. Because this is a pre-authentication vulnerability, no login is required, and the attacker can leverage a time-based SQL injection technique to query the database. This could allow them to extract sensitive information, such as user credentials and valid JWT tokens, potentially leading to account takeover.

No authentication required.
Trigger via SSO OAuth endpoint.
Risk of data theft and account takeover.

Live Threat

Current exploitation, exposure, and threat context

This pre-authentication blind SQL injection vulnerability could allow an unauthenticated attacker to access sensitive database information. When supported by the advisory, this could include personally identifiable information, credentials, and valid JWT tokens, potentially leading to account takeover.

Sensitive database contents.
Via the SSO OAuth endpoint.
Account takeover.

Operational Fix

Recommended remediation, mitigation, and detection steps

This vulnerability impacts the Koollab LMS, specifically its SSO OAuth endpoint, which is likely internet-facing. Infrastructure and security teams should prioritize identifying all instances of Koollab LMS, confirming their exposure and business criticality. Once instances are identified and owners are confirmed, a risk-based remediation plan can be developed, potentially involving vendor coordination and careful maintenance window planning.

Identify Koollab LMS instances and owners.
Verify external reachability and business impact.
Plan remediation based on verified risk.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is Koollab LMS?

Koollab LMS is a Learning Management System designed to handle educational content and user identity management. It serves as a central platform where organizations manage training and courses, often integrating with external services through Single Sign-On (SSO) features to streamline how users authenticate and access their profiles.

What does SQL injection mean for CVE-2026-63229?

SQL injection is a security flaw where an attacker inputs malicious code into a database query. In this case, it is a blind, time-based injection, meaning the attacker observes how long the system takes to respond to certain queries to guess information. This allows them to bypass normal security and extract sensitive data like user credentials and authentication tokens from the underlying database.

How is the vulnerability triggered in Koollab LMS?

The vulnerability is triggered by sending specially crafted requests to the system's SSO OAuth endpoint. Because this is a pre-authentication issue, an attacker does not need to log in or hold a valid account to initiate the attack. However, the attack requires specifically formatted requests aimed at this identity service; standard, legitimate user authentication traffic does not trigger the vulnerability.

Is my Koollab LMS instance at risk?

According to Halo Surface Signal, this vulnerability is very likely to be reachable because it resides in an SSO OAuth endpoint. These portals are typically designed to be internet-accessible to facilitate remote user logins and identity federation, meaning most standard deployments of this software are natively exposed to the internet.

How should I respond to this threat?

Start by identifying all instances of Koollab LMS operating within your environment. Once you have a complete inventory, verify whether these instances are reachable from the internet. Coordinate with your infrastructure teams to confirm ownership of these systems and determine their business criticality so you can develop a prioritized plan for maintenance or updates.

References

www.csa.gov.sg/alerts-and-advisories/alerts/al-2026-094/

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.