CVE-2026-54733 moodle-local_o365: Authentication bypass via unverified JWT signature in Teams SSO endpoint
An unauthenticated attacker can forge a JWT token to bypass signature verification and gain unauthorized Moodle sessions as an Office 365 user.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-54733?
CVE-2026-54733 is a critical authentication bypass vulnerability in microsoft o365-moodle, published on 16 Jul 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
The Microsoft 365 and Microsoft Entra ID Plugins for Moodle provide Office 365 and Azure Active Directory integration for Moodle. Prior to 4.5.6, 5.0.5, and 5.1.1, the Microsoft Office 365 Integration plugin local_o365 Teams SSO endpoint sso_login.php base64-decodes a JWT payload and authenticates users from the upn claim without verifying the JWT signature, allowing an unauthenticated attacker to forge a token and obtain a Moodle session as an O365-authenticated user. This issue is fixed in versions 4.5.6, 5.0.5, and 5.1.1.
Weakness: CWE-347
Which versions are affected by CVE-2026-54733?
How do I fix CVE-2026-54733?
No fix has been published for CVE-2026-54733 yet. Limit exposure of the affected software until one is available.
Upgrade, and rotate credentials and sessions that may have been exposed. More about Authentication bypass.
Is CVE-2026-54733 being exploited?
There is no known exploitation of CVE-2026-54733 in the wild and no public exploit code.
Sources
Also known as GHSA-hqjh-93qv-47v5.