CVE-2026-56877: Skillable SCORM Auth Bypass Vulnerability

CVE-2026-56877 Overview

CVE-2026-56877 is an authorization flaw in the Skillable SCORM lab launch endpoint hosted at scorm.skillable.com through 2026-07-13. The endpoint fails to validate the client-supplied userId parameter against the authenticated SCORM session token. An authenticated user can substitute arbitrary userId values to bypass per-user lab launch rate limits and consume other users' lab allocations. This behavior enables denial of service against targeted users' lab and exam access. Skillable was formerly known as Learn on Demand Systems. The weakness is classified under [CWE-472] External Control of Assumed-Immutable Web Parameter.

Critical Impact
Authenticated attackers can exhaust other users' lab quotas by tampering with the userId parameter, denying legitimate users access to training labs and exams.

Affected Products

Skillable SCORM lab launch service (scorm.skillable.com) through 2026-07-13
Learn on Demand Systems platform (former name of Skillable)
Integrations relying on the Skillable SCORM launch API for lab and exam delivery

Discovery Timeline

2026-07-13 - CVE-2026-56877 published to NVD
2026-07-16 - Last updated in NVD database

Technical Details for CVE-2026-56877

Vulnerability Analysis

The Skillable SCORM lab launch endpoint accepts a userId parameter supplied by the client during lab initiation. The backend uses this value to attribute the launch and to enforce per-user rate limits and lab allocation quotas. The endpoint does not cross-check the supplied userId against the identity bound to the authenticated SCORM session token. An authenticated attacker can therefore submit requests that reference other legitimate users' identifiers.

When the server accepts the substituted identifier, launches, throttling counters, and consumed allocations are attributed to the victim account. Because SCORM sessions are commonly issued to any authenticated learner, the attack requires only low-privilege access. The impact scales with how tightly Skillable customers rely on the platform for time-boxed exams and instructor-led lab sessions.

Root Cause

The root cause is trust in a client-controlled parameter that should be derived from the server-side session context. The application treats userId as an assumed-immutable value while it is fully attacker-controlled, which aligns with [CWE-472]. A correct design would resolve the acting user identity from the SCORM session token and ignore any userId supplied by the client.

Attack Vector

Exploitation is performed over the network by an authenticated user with a valid SCORM session. The attacker intercepts or crafts a lab launch request and replaces the userId field with the identifier of a targeted victim. Repeated requests consume the victim's per-user lab launch quota and trigger their rate limits, blocking legitimate launches. No user interaction from the victim is required. Refer to the Openwall OSS Security Post and the Full Disclosure Security Update for reporter-supplied technical detail.

Detection Methods for CVE-2026-56877

Indicators of Compromise

Lab launch requests where the userId parameter does not match the account identity bound to the SCORM session token.
Unusual spikes in lab launches attributed to a single user account from source IPs, devices, or session tokens not previously associated with that user.
Legitimate users reporting exhausted lab allocations or rate-limit denials without corresponding launch activity in their own audit history.

Detection Strategies

Correlate SCORM session token identity claims with the userId submitted on each lab launch request and alert on mismatches.
Baseline per-user lab launch frequency and flag statistical outliers, particularly launches attributed to a user from unfamiliar client fingerprints.
Review web access logs at scorm.skillable.com integrations for repeated launches iterating across sequential or enumerated userId values.

Monitoring Recommendations

Forward SCORM launch API access logs and authentication events to a centralized analytics platform for retention and correlation.
Monitor help-desk tickets related to lab quota exhaustion and pivot into launch logs for the affected accounts.
Track failure rates of legitimate lab launches per tenant to identify systemic quota abuse.

How to Mitigate CVE-2026-56877

Immediate Actions Required

Contact Skillable and confirm that the SCORM lab launch endpoint has been updated to derive user identity from the session token rather than a client-supplied userId.
Review recent lab launch logs for parameter tampering and reset affected users' quotas where abuse is confirmed.
Restrict access to the SCORM launch integration to trusted learner populations and enforce strong session controls.

Patch Information

Remediation is delivered by Skillable as a service-side fix. Consult the Skillable Security Resource for the vendor's advisory and confirmation that server-side validation now binds the acting userId to the SCORM session token. No customer-installable patch is required because the vulnerable code runs in the Skillable-hosted service.

Workarounds

Where feasible, disable direct SCORM launch integrations for high-value exams until the vendor confirms remediation.
Add upstream request inspection at the LMS or reverse proxy to strip or normalize the userId parameter before it reaches the SCORM endpoint.
Increase per-tenant lab allocation buffers to reduce the impact of quota exhaustion while remediation is validated.

bash

# Example reverse proxy rule to drop client-supplied userId on SCORM launches
# NGINX snippet - adjust location to match your integration path
location /scorm/launch {
    if ($arg_userId) {
        return 400 "userId parameter is not permitted";
    }
    proxy_pass https://scorm.skillable.com;
}