An unauthenticated remote attacker can send a specially crafted POST request to the Learning Management System to bypass both password and OAuth authentication, gaining unauthorized access to user accounts and full administrative control of the platform. This flaw represents a classic authentication bypass weakness, identified as CWE-287, which compromises the integrity of the system's access controls.

The vulnerability targets WizLearn Technologies Pte. Ltd.'s Learning Management System. No specific version information is provided, so all supported versions of the LMS may be affected until a patch is released.

The CVSS score of 9.8 indicates a critical severity. The EPSS score is not available, and the vulnerability is not listed in CISA's KEV catalog, but the absence of mitigation information combined with the remote, unauthenticated attack vector suggests a high likelihood of exploitation. The attacker only needs to craft a POST request to a predictable endpoint, and no special prerequisites are described, making the attack easy to execute from any network that can reach the LMS.