PT-2026-29122 · Openolat · Openolat

Fkt · Publicado 2026-03-30 · Atualizado 2026-03-31 · CVE-2026-31946

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Crítica

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions OpenOlat versions 10.5.4 through 20.2.4

Description OpenOlat is a web-based e-learning platform. The OpenID Connect implicit flow implementation does not verify JSON Web Token (JWT) signatures. The JSONWebToken.parse() method discards the signature segment of the JWT, and the getAccessToken() methods in OpenIdConnectApi and OpenIdConnectFullConfigurableApi only validate claim-level fields without cryptographic signature verification against the Identity Provider's JWKS endpoint. This allows an attacker to craft any token and claim any identity, potentially gaining control of the entire e-learning platform.

Recommendations Update OpenOlat to version 20.2.5.

Exploit

Correção

Improper Authentication

Improper Verification of Cryptographic Signature

Enumeração de Fraquezas

CWE-287

CWE-347

Identificadores relacionados

CVE-2026-31946

GHSA-V8VP-X4Q4-2VCH

Produtos afetados

Openolat

Referências · 9

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/31xxx/CVE-2026-31946.json · Exploit
• https://github.com/OpenOLAT/OpenOLAT/security/advisories/GHSA-v8vp-x4q4-2vch · Aviso do Fabricante
• https://osv.dev/vulnerability/CVE-2026-31946 · Aviso do Fabricante
• https://twitter.com/CveFindCom/status/2038733750905835939 · Publicação no Twitter
• https://twitter.com/TheHackerWire/status/2038738293937012932 · Publicação no Twitter
• https://twitter.com/CosmicBytez/status/2039089067066114239 · Publicação no Twitter
• https://twitter.com/CVEnew/status/2038916083701461454 · Publicação no Twitter
• https://twitter.com/0dayPublishing/status/2038721513424105494 · Publicação no Twitter
• https://nvd.nist.gov/vuln/detail/CVE-2026-31946 · Nota de Segurança