PT-2026-35025 · Lightspeed · Lightspeed Classroom

Published 2026-04-24 · Updated 2026-04-27 · CVE-2026-30368

Positive Technologies (AI Summary)

CVSS v3.1

5.4

Medium

Base vector

AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Lightspeed Classroom version 5.1.2.1763770643

Description A client-side authorization flaw allows unauthenticated attackers to impersonate users. This is achieved by bypassing integrity checks and abusing client-generated authorization tokens, which can lead to unauthorized control and monitoring of student devices.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Incorrect Authorization

Weakness Enumeration

CWE-863

Related Identifiers

CVE-2026-30368

Affected Products

Lightspeed Classroom

References · 8

• 🔥 https://github.com/truekas/ls-poc · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2026-30368 · Security Note
• https://twitter.com/infoflowcloud/status/2048101491307663691 · Twitter Post
• https://tasty-hovercraft-9b9.notion.site/Enabling-Unauthorized-Remote-Control-of-Student-Devices-with-Lightspeed-Classroom-2ec5157f5b4a800c9eefc5526479820a · Note
• https://t.me/cveNotify/161031 · Telegram Post
• https://twitter.com/CVEnew/status/2048099355295404357 · Twitter Post
• https://incognitotgt.me/blog/lightspeed · Note
• https://t.me/cveNotify/161042 · Telegram Post