CVE-2026-30368

A client-side authorization flaw in Lightspeed Classroom v5.1.2.1763770643 allows unauthenticated attackers to impersonate users by bypassing integrity checks and abusing client-generated authorization tokens, leading to unauthorized control and monitoring of student devices.

Affected

Lightspeed · Lightspeed Classroom

CVSS v3.1 MITRE

5.4 MEDIUMCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:N

EPSS

0.34% chance of exploitation in the next 30 days, 26th percentile

Published

2026-04-24

Updated

2026-09-08

Proof-of-concept exploits (1)

• truekas/ls-poc12★ · 2026-04-26

References

• CVE Record
• NVD entry