Signal is active with 2 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
OpenOlat is an open source web-based e-learning platform for teaching, learning, assessment and communication. From version 10.5.4 to before version 20.2.5, OpenOLAT's OpenID Connect implicit flow implementation does not verify JWT signatures. The JSONWebToken.parse() method silently discards the signature segment of the compact JWT (header.payload.signature), and the getAccessToken() methods in both OpenIdConnectApi and OpenIdConnectFullConfigurableApi only validate claim-level fields (issuer, audience, state, nonce) without any cryptographic signature verification against the Identity Provider's JWKS endpoint. This issue has been patched in version 20.2.5.
Priority
LOW
Exploitation
NONE
PoC
NONE
Patch
AVAILABLE
Momentum
STABLE
If you run products in this scope, you should treat this CVE as relevant to your environment.
| Date | Total | Labels |
|---|
| 2026-03-30 | 3 | Disclosure2Patch1 |
| 2026-03-31 | 2 | Disclosure2 |
Security Advisory: CVE-2026-31946: Critical JWT Signature Verification Bypass in OpenOlat E-Learning Platform https://labs.cosmicbytez.ca/security/cve-2026-31946 #Cybersecurity #InfoSec #CVE #PatchNow
Post summary
The advisory announces a critical JWT signature verification bypass in OpenOlat, informing users of the vulnerability and prompting timely patching.
CVE-2026-31946 OpenOlat is an open source web-based e-learning platform for teaching, learning, assessment and communication. From version 10.5.4 to before version 20.2.5, OpenOLAT'… https://www.cve.org/CVERecord?id=CVE-2026-31946
Post summary
The post announces CVE‑2026‑31946 as a vulnerability in OpenOLAT versions 10.5.4 to 20.2.5, but provides no PoC, exploit details, or patch information.
🔴 CVE-2026-31946 - Critical OpenOlat is an open source web-based e-learning platform for teaching, learning, assessment and communication. From version 10.5.4 to before version 20.2.5, OpenOLAT's OpenID Connect impl... https://www.thehackerwire.com/vulnerability/CVE-2026-31946/ https://t.co/OFNySdlB37
Post summary
The post announces the identification of CVE‑2026‑31946 in OpenOLAT, noting affected version ranges but providing no evidence of PoC, exploit availability, active exploitation, or mitigation steps.
[CVE-2026-31946: CRITICAL] OpenOlat, an e-learning platform, had a cyber security flaw in versions 10.5.4 to 20.2.4 with OpenID Connect not verifying JWT signatures. Update to version 20.2.5 to fix this.#cve,CVE-2026-31946,#cybersecurity https://cvefind.com/CVE-2026-31946
Post summary
OpenOlat’s e‑learning platform versions 10.5.4 to 20.2.4 suffered a critical flaw where OpenID Connect failed to verify JWT signatures; updating to version 20.2.5 resolves the issue.
🚨 CVE-2026-31946: OpenOLAT: Aut... JWT.parse() silently drops signatures—craft any token, claim any identity, own the entire e-learning platform. #JWTFail #AuthBypass #OIDC. https://zerodaysignal.com/vulnerability/CVE-2026-31946 #netsec #vulnerability #CVE #sysadmin #zeroday
Post summary
The post announces a new CVE (CVE‑2026‑31946) against OpenOLAT, describing a JWT signature bypass that could let anyone impersonate any identity. No PoC, exploit code, patch, or evidence of active exploitation is provided.
1 of 1 entries
| Part | Vendor | Product | Version | Target SW | Target HW |
|---|---|---|---|---|---|
| App | frentix | openolat | - | - | - |