Executive Summary

This vulnerability exists in OpenOLAT's OpenID Connect implicit flow implementation from versions 10.5.4 to before 20.2.5. The issue is that the system does not verify the cryptographic signatures of JSON Web Tokens (JWTs). Specifically, the JSONWebToken.parse() method ignores the signature part of the JWT, and the methods that retrieve access tokens only validate claim-level fields such as issuer, audience, state, and nonce without checking the signature against the Identity Provider's JWKS endpoint.

Because the signature is not verified, an attacker could potentially forge tokens and gain unauthorized access.

This vulnerability was fixed in OpenOLAT version 20.2.5.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can have severe impacts because it allows attackers to bypass authentication by forging JWTs without valid signatures.

• Unauthorized access to user accounts or sensitive information.
• Potential full compromise of the affected OpenOLAT system.
• Loss of confidentiality, integrity, and availability of the system and its data.

Useful 0 Not Useful 0

Mitigation Strategies

To mitigate this vulnerability, you should upgrade OpenOLAT to version 20.2.5 or later, where the issue with JWT signature verification in the OpenID Connect implicit flow has been patched.

Useful 0 Not Useful 0

Compliance Impact

The vulnerability in OpenOlat's OpenID Connect implicit flow implementation allows JWT signatures to go unverified, which can lead to unauthorized access and compromise of sensitive data.

Such a security flaw can negatively impact compliance with common standards and regulations like GDPR and HIPAA, which require strong authentication mechanisms and protection of personal and sensitive information.

Failure to verify JWT signatures undermines the integrity and authenticity of user sessions, potentially leading to data breaches that violate these regulations.

Useful 0 Not Useful 0