PT-2026-29122 · Openolat · Openolat

Fkt · Published 2026-03-30 · Updated 2026-03-31 · CVE-2026-31946

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions OpenOlat versions 10.5.4 through 20.2.4

Description OpenOlat is a web-based e-learning platform. The OpenID Connect implicit flow implementation does not verify JSON Web Token (JWT) signatures. The JSONWebToken.parse() method discards the signature segment of the JWT, and the getAccessToken() methods in OpenIdConnectApi and OpenIdConnectFullConfigurableApi only validate claim-level fields without cryptographic signature verification against the Identity Provider's JWKS endpoint. This allows an attacker to craft any token and claim any identity, potentially gaining control of the entire e-learning platform.

Recommendations Update OpenOlat to version 20.2.5.

Exploit

Fix

Improper Authentication

Improper Verification of Cryptographic Signature

Weakness Enumeration

CWE-287

CWE-347

Related Identifiers

CVE-2026-31946

GHSA-V8VP-X4Q4-2VCH

Affected Products

Openolat

References · 9

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/31xxx/CVE-2026-31946.json · Exploit
• https://github.com/OpenOLAT/OpenOLAT/security/advisories/GHSA-v8vp-x4q4-2vch · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2026-31946 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-31946 · Security Note
• https://twitter.com/CveFindCom/status/2038733750905835939 · Twitter Post
• https://twitter.com/TheHackerWire/status/2038738293937012932 · Twitter Post
• https://twitter.com/CosmicBytez/status/2039089067066114239 · Twitter Post
• https://twitter.com/CVEnew/status/2038916083701461454 · Twitter Post
• https://twitter.com/0dayPublishing/status/2038721513424105494 · Twitter Post