This vulnerability in Koollab LMS (version 5.3.2) involves an authentication bypass via the 2FA validation endpoint. An attacker can bypass primary credential checks by submitting a valid user UUID, enabling unauthorized access to any account, including administrators. The CVSS 3.1 base score is 6.5, reflecting network attack vector, high attack complexity, no privileges required, no user interaction, and high confidentiality impact with limited integrity impact and no availability impact. No official patch or remediation guidance is currently available, and no known exploits are reported in the wild.

Successful exploitation allows an unauthenticated attacker to fully compromise any user account, including those with administrative privileges. This leads to a high confidentiality impact due to unauthorized data access and a limited integrity impact. There is no impact on availability.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict access to the 2FA validation endpoint where possible and monitor for suspicious activity related to UUID submissions. Avoid exposing valid user UUIDs publicly to reduce risk.