Pre-Authentication SQL Injection in LMS OAuth SSO Endpoint

A pre-authentication blind SQL injection vulnerability in Koollab LMS allowed an unauthenticated attacker to use a time-based SQL oracle via the SSO OAuth endpoint to read sensitive database contents, including personally identifiable information, credentials, and valid JWT tokens that may enable account takeover.

Casky was already ahead

This CVE exploits attack patterns that Casky's 322matched skills already investigate — long before this vulnerability was disclosed. Claude's reasoning model maps these techniques to MITRE ATT&CK, so practitioners who ran these skills have already seen the threat behaviour in their findings.

Analysis

This critical vulnerability (CVSS 9.1) exploits a blind SQL injection flaw in Koollab LMS's Single Sign-On OAuth endpoint, allowing unauthenticated attackers to extract sensitive data without credentials. By leveraging time-based SQL oracle techniques, threat actors can systematically read database contents including personally identifiable information, user credentials, and JWT tokens—creating a direct pathway to account takeover and system compromise. Any organization deploying Koollab LMS with SSO enabled faces immediate risk, as the attack requires no prior authentication and can be executed remotely.

Casky's 322 matching skills detect the attack patterns underlying this vulnerability by mapping to MITRE ATT&CK techniques TA0001 (Reconnaissance) and TA0043 (Reconnaissance). Extended reasoning through Claude identifies characteristic indicators: unusual timing patterns in OAuth endpoint responses, repetitive database query delays consistent with time-based injection probing, and anomalous parameter manipulation in SSO authentication flows. Practitioners using Casky would observe findings flagging suspicious request sequences to the OAuth endpoint, time-variance analysis suggesting information exfiltration attempts, and credential-stealing patterns associated with JWT token extraction—enabling rapid detection before attackers can weaponize stolen credentials for lateral movement or persistence.

Live Threat IntelligenceComing soon

Casky Risk Score

—

EPSS Probability

—

Shodan Exposure

—

GreyNoise Signal

—

Composite risk scoring from EPSS, CISA KEV, Shodan, and GreyNoise — 21 security APIs correlated into a single Casky Risk Score. Coming in Casky Pro. Join early access →

322 Casky skills cover this attack pattern

These skills use Claude AI's reasoning model to surface findings in the same attack categories as CVE-2026-63229.

Abuse of Public-Facing API: Mobile API Abuse

mobile security · low

Run

abusing-dpapi-for-credential-access

red teaming · high

Run

abusing-shadow-credentials-for-privesc

red teaming · high

Run

MITRE ATT&CK Techniques

TA0001 TA0043

Investigate the attack patterns behind CVE-2026-63229

Casky has 322 skills that investigate the attack patterns behind CVE-2026-63229. Run one and get CVSS-scored findings in 3 minutes.

Run the skill that detects this →

X Instagram LinkedIn