CVE-2026-63235 Three Learning CVE debrief

Who should care

Defenders responsible for Koollab LMS deployments should assess exposure and potential impact on user sessions, focusing on verifying exposure and assessing impact. This includes reviewing the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance.

Why it matters

CVE-2026-63235 is a low-severity vulnerability in Koollab LMS that allows an unauthenticated attacker to terminate user sessions, potentially disrupting productivity. Defenders should verify exposure and assess impact.

• Denial of service through session termination
• Potential disruption to user productivity
• Need for verification of exposure and impact

Technical summary

The vulnerability allows an unauthenticated attacker to forcibly terminate the session of any user given their email address via the login kickout endpoint, resulting in a denial of service. This improper access control vulnerability in Koollab LMS has a CVSS score of 3.7 and a low severity. Defenders should prioritize verifying exposure and assessing potential impact on user sessions.

Defensive priority

Defenders should prioritize verifying exposure and assessing potential impact on user sessions.

Recommended defensive actions

• Verify exposure to the Koollab LMS login kickout endpoint
• Assess potential impact on user sessions
• Monitor for unauthorized session termination attempts

Evidence notes

The CVE record and NVD entry provide details on the vulnerability, but additional information on affected versions, remediation, and potential impact is not available. Defenders should verify exposure and assess potential impact on user sessions. The vulnerability allows an unauthenticated attacker to forcibly terminate the session of any user given their email address via the login kickout endpoint, resulting in a denial of service.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.