The vulnerability originates from incorrect access control on Totara LMS’s login page, permitting an attacker to manipulate front‑end code to expose the login form. When combined with the absence of rate limiting on the login endpoint, this flaw enables a brute‑force attack to discover valid credentials. Despite the vendor’s dispute—citing server‑side controls over local login, lack of evidence of SSO bypass, and no ability to perform local login when disabled—the reported behavior indicates that unauthorized users could potentially gain account access, compromising confidentiality and other security properties. The weakness aligns with CWE‑284.

Totara Learning Management System versions 19.1.5 and earlier are affected. The vulnerability has been identified in the official deployments of Totara LMS and could affect organizations running those releases.

The CVSS score of 9.8 indicates a critical severity. The EPSS score of less than 1% suggests that exploitation is unlikely to be widespread at present, but the vulnerability remains a high‑risk target for attackers. The issue is not listed in the CISA KEV catalog. The attack vector is inferred to be remote, via an unprotected web interface that can be accessed over the network. An attacker would only need to identify the vulnerable login endpoint and start a brute‑force campaign, which the lack of rate limiting would allow to proceed with minimal delay.