CVE-2026-30368

A client-side authorization flaw in Lightspeed Classroom v5.1.2.1763770643 allows unauthenticated attackers to impersonate users by bypassing integrity checks and abusing client-generated authorization tokens, leading to unauthorized control and monitoring of student devices.

CVSS v3.1

5.4 MEDIUMCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:N

EPSS

0.35% chance of exploitation in the next 30 days, 27th percentile

Published

2026-04-24

Updated

2026-04-27

Proof-of-concept exploits (1)

• truekas/ls-poc15★ · 2026-04-26

References

• CVE Record
• NVD entry

Related

• CVE-2026-3035
• CVE-2026-3040
• CVE-2026-30345
• CVE-2026-3041
• CVE-2026-30332
• CVE-2026-3042