CVE-2026-31946 OpenOLAT: Authentication bypass via forged JWT in OIDC implicit flow
Attackers can bypass authentication in OpenOLAT by forging JWTs in the OIDC implicit flow, gaining unauthorized access to user accounts.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-31946?
CVE-2026-31946 is a critical authentication bypass vulnerability in OpenOLAT, published on 30 Mar 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
OpenOlat is an open source web-based e-learning platform for teaching, learning, assessment and communication. From version 10.5.4 to before version 20.2.5, OpenOLAT's OpenID Connect implicit flow implementation does not verify JWT signatures. The JSONWebToken.parse() method silently discards the signature segment of the compact JWT (header.payload.signature), and the getAccessToken() methods in both OpenIdConnectApi and OpenIdConnectFullConfigurableApi only validate claim-level fields (issuer, audience, state, nonce) without any cryptographic signature verification against the Identity Provider's JWKS endpoint. This issue has been patched in version 20.2.5.
Which versions are affected by CVE-2026-31946?
It affects 1 product.
Products include Frentix Openolat.
How do I fix CVE-2026-31946?
No fix has been published for CVE-2026-31946 yet. Limit exposure of the affected software until one is available.
Upgrade, and rotate credentials and sessions that may have been exposed. More about Authentication bypass.
Is CVE-2026-31946 being exploited?
There is no known exploitation of CVE-2026-31946 in the wild and no public exploit code.
Other vulnerabilities in OpenOLAT
- CVE-2026-28228 OpenOLAT: Server-Side Template Injection (SSTI) in Velocity templates allows Remote Code Execution
- CVE-2021-39181 Unsafe Deserialization of User Data Using XStream
- CVE-2021-41242 Path Traversal in some REST methods leading to file upload to arbitrary places
- CVE-2021-39180 Path Traversal in Archive Handling Leading to Code Execution
- CVE-2021-41152 Path Traversal in Folder Component Leading to Local File Inclusion
Sources
Also known as GHSA-v8vp-x4q4-2vch.