An unauthenticated client‑side authorization flaw in Lightspeed Classroom v5.1.2.1763770643 allows attackers to bypass integrity checks and forge client‑generated authorization tokens, giving them the ability to impersonate legitimate users and gain control and monitoring capabilities of student devices. The weakness is classified as CWE‑863 (Authorization Bypass through User-Controlled Key). The impact includes unauthorized remote device control, potential data exfiltration, and disruption of classroom management.*

The vulnerability affects Lightspeed Classroom version 5.1.2.1763770643. No other versions or products are listed at this time.*

The CVSS score of 5.4 indicates a moderate severity. The EPSS score of less than 1% suggests a very low likelihood of exploitation, and the vulnerability is not listed in the CISA KEV catalog. The attack vector is client‑side; the flaw can be exercised by any entity able to interact with the Classroom client, whether by only providing forged tokens or by directly accessing the client’s network endpoints. Detailed exploitation steps are not supplied in the advisory, but the description implies that an attacker can impersonate a user without needing prior authentication.*