CVE-2026-0953 Social Login OAuth Authentication Bypass

CVE-2026-0953 is a critical-severity vulnerability. AttackerView checks Tutor LMS sites for it with a live exploit check.

Is my site vulnerable to CVE-2026-0953?

Detects Tutor LMS Pro plugin at version 3.9.5 or earlier where the Social Login addon accepts a user-supplied email in the OAuth callback without verifying it matches the email from the validated token claims. An unauthenticated attacker can authenticate with their own OAuth account but substitute the victim’s email, logging in as any user including administrators.