CVE-2026-31946
JWT Signature Bypass in OpenOLAT OpenID Connect Impacts Authentication
Publication date: 2026-03-30
Last updated on: 2026-04-02
Assigner: GitHub, Inc.
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| frentix | openolat | From 10.5.4 (inc) to 20.2.5 (exc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-287 | When an actor claims to have a given identity, the product does not prove or insufficiently proves that the claim is correct. |
| CWE-347 | The product does not verify, or incorrectly verifies, the cryptographic signature for data. |
Attack-Flow Graph
AI Powered Q&A
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
The vulnerability in OpenOlat's OpenID Connect implicit flow implementation allows JWT signatures to go unverified, which can lead to unauthorized access and compromise of sensitive data.
Such a security flaw can negatively impact compliance with common standards and regulations like GDPR and HIPAA, which require strong authentication mechanisms and protection of personal and sensitive information.
Failure to verify JWT signatures undermines the integrity and authenticity of user sessions, potentially leading to data breaches that violate these regulations.
Can you explain this vulnerability to me?
This vulnerability exists in OpenOLAT's OpenID Connect implicit flow implementation from versions 10.5.4 to before 20.2.5. The issue is that the system does not verify the cryptographic signatures of JSON Web Tokens (JWTs). Specifically, the JSONWebToken.parse() method ignores the signature part of the JWT, and the methods that retrieve access tokens only validate claim-level fields such as issuer, audience, state, and nonce without checking the signature against the Identity Provider's JWKS endpoint.
Because the signature is not verified, an attacker could potentially forge tokens and gain unauthorized access.
This vulnerability was fixed in OpenOLAT version 20.2.5.
How can this vulnerability impact me? :
This vulnerability can have severe impacts because it allows attackers to bypass authentication by forging JWTs without valid signatures.
- Unauthorized access to user accounts or sensitive information.
- Potential full compromise of the affected OpenOLAT system.
- Loss of confidentiality, integrity, and availability of the system and its data.
What immediate steps should I take to mitigate this vulnerability?
To mitigate this vulnerability, you should upgrade OpenOLAT to version 20.2.5 or later, where the issue with JWT signature verification in the OpenID Connect implicit flow has been patched.