OpenOLAT OpenID Connect Implementation Vulnerability in E-learning Platform
CVE-2026-31946

9.8CRITICAL

Key Information:

Vendor

Openolat

Status
Openolat
Vendor
CVE Published:
30 March 2026

What is CVE-2026-31946?

OpenOLAT, an open source web-based e-learning platform, has a vulnerability in its OpenID Connect implementation. Specifically, versions from 10.5.4 to before 20.2.5 fail to verify JSON Web Token (JWT) signatures adequately. This flaw arises because the JSONWebToken.parse() method neglects to validate the signature segment of the compact JWT format. As a result, the access token retrieval methods in OpenIdConnectApi and OpenIdConnectFullConfigurableApi only check claim-level fields, such as issuer and audience, without performing necessary cryptographic signature validation against the provided Identity Provider's JWKS endpoint. This oversight could lead to unauthorized access and potential data breaches within the platform. The vulnerability has been addressed in version 20.2.5.

Affected Version(s)

OpenOLAT >= 10.5.4, < 20.2.5

References

https://github.com/OpenOLAT/OpenOLAT/security/advisories/...
x_refsource_CONFIRM

CVSS V3.1

Score:
9.8
Severity:
CRITICAL
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.