{"answers":{"affected":"","exploited":"There is no known exploitation of CVE-2026-54733 in the wild and no public exploit code.","fix":"No fix has been published for CVE-2026-54733 yet. Limit exposure of the affected software until one is available.","what":"CVE-2026-54733 is a critical authentication bypass vulnerability in microsoft o365-moodle, published on 16 Jul 2026. An attacker can exploit it over the internet without logging in, with no action from the victim."},"fix_prompt":"Check this codebase for CVE-2026-54733 and fix it if it is affected.\n\nWhat it is: CVE-2026-54733 is a critical authentication bypass vulnerability in microsoft o365-moodle, published on 16 Jul 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.\nExploitation: There is no known exploitation of CVE-2026-54733 in the wild and no public exploit code.\n\nAffected product: microsoft o365-moodle. No package-level version data is available, so check the vendor advisory linked from the reference page.\n\nTask:\n1. Search the dependency manifests and lockfiles (for example package.json, package-lock.json, requirements.txt, poetry.lock, uv.lock, pom.xml, build.gradle, go.mod, Cargo.lock, Gemfile.lock) and any Dockerfiles for the affected packages, including transitive dependencies.\n2. If an affected version is in use, upgrade it to the fixed version for its release line with the project's package manager, so the lockfile is regenerated. Prefer the smallest upgrade that fixes it.\n3. If there is no fix, or the upgrade would break the build, do not guess: explain the risk and the safest workaround instead.\n4. Run the tests and summarise what changed and why.\n5. If nothing in the project is affected, say so and change nothing.\n\nReference: https://insights.sbomify.com/CVE-2026-54733/ (Markdown: https://insights.sbomify.com/CVE-2026-54733/index.md)","id":"CVE-2026-54733","markdown":"https://insights.sbomify.com/CVE-2026-54733/index.md","name":"CVE-2026-54733","record":{"aliases":["GHSA-hqjh-93qv-47v5"],"analysis":{"component_type":"cms_plugin","fix_type":"upgrade","impacts":["account_takeover","privilege_escalation"],"network_reachable":"yes","non_default_config":false,"product_category":"Moodle Office 365 plugin","requires_auth":"none","summary":"An unauthenticated attacker can forge a JWT token to bypass signature verification and gain unauthorized Moodle sessions as an Office 365 user.","user_interaction":"not_required","vuln_class":"auth_bypass"},"analysis_generated_by":"qwen3.8-flash-next","assigner":"GitHub_M","cpe":[],"cvss":{"score":9.3,"severity":"critical","source":"cna","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","version":"4.0"},"cwes":[{"id":"CWE-347","name":"Improper Verification of Cryptographic Signature"}],"description":"The Microsoft 365 and Microsoft Entra ID Plugins for Moodle provide Office 365 and Azure Active Directory integration for Moodle. Prior to 4.5.6, 5.0.5, and 5.1.1, the Microsoft Office 365 Integration plugin local_o365 Teams SSO endpoint sso_login.php base64-decodes a JWT payload and authenticates users from the upn claim without verifying the JWT signature, allowing an unauthenticated attacker to forge a token and obtain a Moodle session as an O365-authenticated user. This issue is fixed in versions 4.5.6, 5.0.5, and 5.1.1.","ecosystems":[],"exploits":{"exploitdb":0,"first_seen":null,"github_poc":0,"max_poc_stars":null,"metasploit":0,"nuclei":0,"refs":[],"tier":"none_known"},"has_fix":false,"headline":"moodle-local_o365: Authentication bypass via unverified JWT signature in Teams SSO endpoint","id":"CVE-2026-54733","indexable":true,"kev":null,"kind":"cve","links":{"ecosystem":null,"product":null,"products":[],"type":"auth_bypass","year":"2026"},"n_packages":0,"n_references":7,"next":{"headline":"Prebid Server Java: Vulnerability to request forgery allows for possible host environment data extraction","id":"CVE-2026-54734"},"packages":[],"prev":{"headline":"libreoffice-convert: path traversal / arbitrary file write","id":"CVE-2026-54732"},"products":["o365-moodle"],"published":"2026-07-16","related":[],"sources":[{"class":"attribution","licence":"CVE Terms of Use (MITRE)","name":"CVE List","prefix":"CVE"},{"class":"attribution","licence":"CWE Terms of Use","name":"CWE (MITRE)"},{"class":"attribution","licence":"FIRST CVSS licence","name":"CVSS (FIRST)"}],"ssvc":{"automatable":"yes","exploitation":"none","technical_impact":"total"},"state":"PUBLISHED","updated":"2026-07-16","vendors":["microsoft"]},"summary":"An unauthenticated attacker can forge a JWT token to bypass signature verification and gain unauthorized Moodle sessions as an Office 365 user.","url":"https://insights.sbomify.com/CVE-2026-54733/"}