This vulnerability in Koollab LMS 5.3.2 enables an attacker to bypass authentication by providing a valid user UUID at the 2FA validation endpoint, thereby gaining unauthorized access to any account, including administrative ones. The attacker does not need to supply primary credentials, effectively circumventing the intended authentication process. The CVSS 3.1 vector indicates network attack vector, high attack complexity, no privileges required, no user interaction, unchanged scope, high confidentiality impact, low integrity impact, and no availability impact.

Successful exploitation allows an unauthenticated attacker to take over any user account, including administrators, leading to a high confidentiality breach and partial integrity compromise. This could result in unauthorized access to sensitive information and limited modification capabilities within the LMS environment.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or temporary workaround has been provided at this time. Until a patch is available, restrict access to the 2FA validation endpoint if possible and monitor for suspicious activity related to UUID usage.