The vulnerability stems from hard‑coded AWS IAM credentials embedded in the Koollab LMS application. These credentials grant permissions to shared S3 buckets and SQS queues used by the multi‑tenant platform. An attacker who exploits this flaw can read or write to those buckets and queues, exposing sensitive data, injecting malicious content, manipulating queued jobs, or intercepting e‑mail streams. This flaw is classified as CWE‑798 – use of hard‑coded credentials.

The affected vendor is Three Learning and the product is the Koollab LMS platform. The vulnerability applies to all deployments of this LMS that contain the hard‑coded credentials; no specific version numbers are in the advisory, so any installation prior to the vendor’s latest fix is potentially impacted.

The CVSS v3.1 score of 5.4 indicates a medium severity. The EPSS score of less than 1% suggests a low probability of exploitation under current conditions, and the vulnerability is not listed in the CISA KEV catalog. The likely attack vector is exploitation of the web application through any user that can reach the LMS instance – the hard‑coded credentials are accessed by the application itself, so an attacker only needs network access to the LMS environment read or write the shared S3 buckets and SQS queues. No additional conditions are required beyond connectivity to the LMS instance.