CVE-2026-31946

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-31946", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2026-03-10T15:10:10.656Z", "datePublished": "2026-03-30T20:31:14.919Z", "dateUpdated": "2026-03-31T14:08:07.327Z"}, "containers": {"cna": {"title": "OpenOLAT: Authentication bypass via forged JWT in OIDC implicit flow", "problemTypes": [{"descriptions": [{"cweId": "CWE-287", "lang": "en", "description": "CWE-287: Improper Authentication", "type": "CWE"}]}, {"descriptions": [{"cweId": "CWE-347", "lang": "en", "description": "CWE-347: Improper Verification of Cryptographic Signature", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9.8, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}}], "references": [{"name": "https://github.com/OpenOLAT/OpenOLAT/security/advisories/GHSA-v8vp-x4q4-2vch", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/OpenOLAT/OpenOLAT/security/advisories/GHSA-v8vp-x4q4-2vch"}], "affected": [{"vendor": "OpenOLAT", "product": "OpenOLAT", "versions": [{"version": ">= 10.5.4, < 20.2.5", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-03-30T20:31:14.919Z"}, "descriptions": [{"lang": "en", "value": "OpenOlat is an open source web-based e-learning platform for teaching, learning, assessment and communication. From version 10.5.4 to before version 20.2.5, OpenOLAT's OpenID Connect implicit flow implementation does not verify JWT signatures. The JSONWebToken.parse() method silently discards the signature segment of the compact JWT (header.payload.signature), and the getAccessToken() methods in both OpenIdConnectApi and OpenIdConnectFullConfigurableApi only validate claim-level fields (issuer, audience, state, nonce) without any cryptographic signature verification against the Identity Provider's JWKS endpoint. This issue has been patched in version 20.2.5."}], "source": {"advisory": "GHSA-v8vp-x4q4-2vch", "discovery": "UNKNOWN"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-03-31T14:07:59.235405Z", "id": "CVE-2026-31946", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-03-31T14:08:07.327Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"cna": {"title": "OpenOLAT: Authentication bypass via forged JWT in OIDC implicit flow", "source": {"advisory": "GHSA-v8vp-x4q4-2vch", "discovery": "UNKNOWN"}, "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 9.8, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}}], "affected": [{"vendor": "OpenOLAT", "product": "OpenOLAT", "versions": [{"status": "affected", "version": ">= 10.5.4, < 20.2.5"}]}], "references": [{"url": "https://github.com/OpenOLAT/OpenOLAT/security/advisories/GHSA-v8vp-x4q4-2vch", "name": "https://github.com/OpenOLAT/OpenOLAT/security/advisories/GHSA-v8vp-x4q4-2vch", "tags": ["x_refsource_CONFIRM"]}], "descriptions": [{"lang": "en", "value": "OpenOlat is an open source web-based e-learning platform for teaching, learning, assessment and communication. From version 10.5.4 to before version 20.2.5, OpenOLAT's OpenID Connect implicit flow implementation does not verify JWT signatures. The JSONWebToken.parse() method silently discards the signature segment of the compact JWT (header.payload.signature), and the getAccessToken() methods in both OpenIdConnectApi and OpenIdConnectFullConfigurableApi only validate claim-level fields (issuer, audience, state, nonce) without any cryptographic signature verification against the Identity Provider's JWKS endpoint. This issue has been patched in version 20.2.5."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-287", "description": "CWE-287: Improper Authentication"}]}, {"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-347", "description": "CWE-347: Improper Verification of Cryptographic Signature"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-03-30T20:31:14.919Z"}}, "adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-31946", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-03-31T14:07:59.235405Z"}}}], "providerMetadata": {"shortName": "CISA-ADP", "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "dateUpdated": "2026-03-31T14:08:03.414Z"}}]}, "cveMetadata": {"cveId": "CVE-2026-31946", "state": "PUBLISHED", "dateUpdated": "2026-03-30T20:31:14.919Z", "dateReserved": "2026-03-10T15:10:10.656Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2026-03-30T20:31:14.919Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"product": "OpenOLAT", "vendor": "OpenOLAT", "versions": [{"status": "affected", "version": ">= 10.5.4, < 20.2.5"}]}], "source": "security-advisories@github.com"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:frentix:openolat:*:*:*:*:*:*:*:*", "matchCriteriaId": "92EBC184-1E84-4766-8671-2DB919EEDF37", "versionEndExcluding": "20.2.5", "versionStartIncluding": "10.5.4", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "OpenOlat is an open source web-based e-learning platform for teaching, learning, assessment and communication. From version 10.5.4 to before version 20.2.5, OpenOLAT's OpenID Connect implicit flow implementation does not verify JWT signatures. The JSONWebToken.parse() method silently discards the signature segment of the compact JWT (header.payload.signature), and the getAccessToken() methods in both OpenIdConnectApi and OpenIdConnectFullConfigurableApi only validate claim-level fields (issuer, audience, state, nonce) without any cryptographic signature verification against the Identity Provider's JWKS endpoint. This issue has been patched in version 20.2.5."}, {"lang": "es", "value": "OpenOlat es una plataforma de e-learning de c\u00f3digo abierto basada en la web para la ense\u00f1anza, el aprendizaje, la evaluaci\u00f3n y la comunicaci\u00f3n. Desde la versi\u00f3n 10.5.4 hasta antes de la versi\u00f3n 20.2.5, la implementaci\u00f3n del flujo impl\u00edcito de OpenID Connect de OpenOLAT no verifica las firmas JWT. El m\u00e9todo JSONWebToken.parse() descarta silenciosamente el segmento de la firma del JWT compacto (encabezado.carga \u00fatil.firma), y los m\u00e9todos getAccessToken() tanto en OpenIdConnectApi como en OpenIdConnectFullConfigurableApi solo validan campos a nivel de declaraci\u00f3n (emisor, audiencia, estado, nonce) sin ninguna verificaci\u00f3n criptogr\u00e1fica de la firma contra el endpoint JWKS del Proveedor de Identidad. Este problema ha sido parcheado en la versi\u00f3n 20.2.5."}], "id": "CVE-2026-31946", "lastModified": "2026-06-17T10:34:49.370", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9.8, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 5.9, "source": "security-advisories@github.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-31946", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "total"}], "role": "CISA Coordinator", "timestamp": "2026-03-31T14:07:59.235405Z", "version": "2.0.3"}}]}, "published": "2026-03-30T21:17:09.440", "references": [{"source": "security-advisories@github.com", "tags": ["Mitigation", "Vendor Advisory"], "url": "https://github.com/OpenOLAT/OpenOLAT/security/advisories/GHSA-v8vp-x4q4-2vch"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-287"}, {"lang": "en", "value": "CWE-347"}], "source": "security-advisories@github.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[10.5.4,20.2.5)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "cna", "scores": [{"score": 100.0, "source": "cna"}]}, "product": "openolat", "vendor": "openolat"}], "analysis": {"en": {"generated_at": "2026-04-02T23:53:32.681811+00:00", "value": {"mitigation_remediation": ["Apply the vendor patch by upgrading to OpenOLAT version 20.2.5 or later to re\u2011enable JWT signature verification.", "Validate that the OIDC endpoints enforce signature verification and fully validate required claims.", "If an upgrade cannot be performed immediately, consider disabling the OIDC implicit flow endpoint to prevent exploitation until a patch is applied."], "summary": {"action": "Patch Now", "impact": "Authentication bypass via forged JWT"}, "threat_synthesis": {"affected_systems": "OpenOLAT installations distributed by Frentix with versions ranging from 10.5.4 up to but not including 20.2.5 are affected. The vulnerability was addressed in version 20.2.5 when proper JWT signature verification was restored.", "description_and_impact": "OpenOLAT\u2019s OpenID Connect implicit flow implementation fails to verify JWT signatures. The JSONWebToken.parse() method discards the signature segment of the compact JWT, and the token validation methods in OpenIdConnectApi and OpenIdConnectFullConfigurableApi only confirm claim\u2011level fields such as issuer, audience, state, and nonce without performing cryptographic signature verification against the Identity Provider\u2019s JWKS endpoint. This flaw enables an attacker to supply a forged JWT that passes the claim checks and obtain an access token that authenticates as any user, effectively bypassing authentication.", "risk_and_exploitability": "The CVSS score of 9.8 denotes critical severity, while the EPSS score of less than 1% suggests a low probability of current exploitation. The vulnerability is not listed in the CISA KEV catalog, indicating no publicly known exploits at present. The likely attack vector is the OIDC implicit flow, where an attacker can supply a forged token without needing additional privileges to bypass authentication."}}}}, "created": "2026-03-31T19:59:54.511967+00:00", "updated": "2026-04-03T09:38:03.780501+00:00", "vendors": ["openolat", "openolat$PRODUCT$openolat"]}