CVE-2026-31946: fallo crítico en OpenOLAT
OpenOLAT: Authentication bypass via forged JWT in OIDC implicit flow
Publicada el · Actualizada el
Aviso por correo cuando entre en el KEV, tenga PoC pública o suba de nota.
28Vexday Risk Score
Sin señal de explotación. Ningún artefacto público de explotación conocido hasta ahora.
ssvc Trackcvss 9.8epss 0.2%
OpenOlat is an open source web-based e-learning platform for teaching, learning, assessment and communication. From version 10.5.4 to before version 20.2.5, OpenOLAT's OpenID Connect implicit flow implementation does not verify JWT signatures. The JSONWebToken.parse() method silently discards the signature segment of the compact JWT (header.payload.signature), and the getAccessToken() methods in both OpenIdConnectApi and OpenIdConnectFullConfigurableApi only validate claim-level fields (issuer, audience, state, nonce) without any cryptographic signature verification against the Identity Provider's JWKS endpoint. This issue has been patched in version 20.2.5.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Productos afectados
OpenOLAT · OpenOLATCVEs relacionadas — OpenOLAT
En el mismo producto, de las más peligrosas a las menos.
CVE-2021-39180HIGHPath Traversal in Archive Handling Leading to Code ExecutionEPSS 2.4%CVE-2021-39181HIGHUnsafe Deserialization of User Data Using XStreamEPSS 1.9%CVE-2021-41242HIGHPath Traversal in some REST methods leading to file upload to arbitrary placesEPSS 1.5%CVE-2021-41152HIGHPath Traversal in Folder Component Leading to Local File InclusionEPSS 1.2%CVE-2024-28198MEDIUMXML external entity (XXE) injection in OpenOLATEPSS 0.4%CVE-2026-28228HIGHOpenOLAT: Server-Side Template Injection (SSTI) in Velocity templates allows Remote Code ExecutionEPSS 0.4%