CVE-2026-30368
MEDIUMLightspeed Classroom 5.1.2.1763770643 - Auth Bypass
Title source: llmExploitation Summary
EIP tracks 2 public exploits for CVE-2026-30368. PoCs published by truekas, adminlove520.
AI-analyzed exploit summary This repository contains a functional PoC for CVE-2026-30368, exploiting a weak authentication flaw in Lightspeed Classroom management to control student devices. The exploit involves extracting a JWT token from a modified service worker and WASM module, then using it to send commands via Ably channels.
Description
A client-side authorization flaw in Lightspeed Classroom v5.1.2.1763770643 allows unauthenticated attackers to impersonate users by bypassing integrity checks and abusing client-generated authorization tokens, leading to unauthorized control and monitoring of student devices.
Exploits (2)
This repository contains a functional PoC for CVE-2026-30368, exploiting a weak authentication flaw in Lightspeed Classroom management to control student devices. The exploit involves extracting a JWT token from a modified service worker and WASM module, then using it to send commands via Ably channels.
This repository contains a functional proof-of-concept exploit for CVE-2026-30368, targeting a weak authentication flaw in Lightspeed Classroom management. The exploit involves extracting a JWT token from a service worker and using it to send commands to student devices via Ably channels.
Scores
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:N