What’s Vulnerable › Vulnerabilities
CVE-2026-31946: OpenOLAT: Authentication bypass via forged JWT in OIDC implicit flow
- Severity: critical (CVSS 9.8 v3.1)
- Exploited in the wild: not listed in CISA KEV
- EPSS: 0.2% probability of exploitation in the next 30 days
- Public exploit or detection template: none known
- Published: 2026-03-30 · updated 2026-06-17
- Weakness: CWE-287
Description
OpenOlat is an open source web-based e-learning platform for teaching, learning, assessment and communication. From version 10.5.4 to before version 20.2.5, OpenOLAT's OpenID Connect implicit flow implementation does not verify JWT signatures. The JSONWebToken.parse() method silently discards the signature segment of the compact JWT (header.payload.signature), and the getAccessToken() methods in both OpenIdConnectApi and OpenIdConnectFullConfigurableApi only validate claim-level fields (issuer, audience, state, nonce) without any cryptographic signature verification against the Identity Provider's JWKS endpoint. This issue has been patched in version 20.2.5.
Affected products
- OpenOLAT: from 10.5.4 before 20.2.5 — fixed in 20.2.5
How to fix
Upgrade to a fixed version: OpenOLAT 20.2.5. Check the vendor advisory for mitigations.
References
Get alerted when CVE-2026-31946 or the next vulnerability affects your stack