CVE-2026-31946 Details
Description
OpenOlat is an open source web-based e-learning platform for teaching, learning, assessment and communication. From version 10.5.4 to before version 20.2.5, OpenOLAT's OpenID Connect implicit flow implementation does not verify JWT signatures. The JSONWebToken.parse() method silently discards the signature segment of the compact JWT (header.payload.signature), and the getAccessToken() methods in both OpenIdConnectApi and OpenIdConnectFullConfigurableApi only validate claim-level fields (issuer, audience, state, nonce) without any cryptographic signature verification against the Identity Provider's JWKS endpoint. This issue has been patched in version 20.2.5.
A vulnerability exists in OpenOLAT versions 10.5.4 prior to 20.2.5, where the OpenID Connect implicit flow implementation fails to verify JSON Web Token (JWT) signatures. The issue arises because the 'JSONWebToken.parse()' method ignores the signature segment of the JWT, and the 'getAccessToken()' methods in both 'OpenIdConnectApi' and 'OpenIdConnectFullConfigurableApi' only check claim-level fields without performing cryptographic signature validation against the Identity Provider's JWKS endpoint. This flaw allows an attacker to forge a JWT and gain unauthorized access to an authenticated session, potentially as an administrator.
Users can upgrade to OpenOLAT version 20.2.5 or later and switch to a different authentication method, as the OIDC implicit flow is no longer supported. For those on version 20.2.5, the OIDC implicit flow login provider can be disabled by setting 'oauth.openidconnectif.enabled=false' in 'olat.local.properties' or by disabling 'OpenID Connect' in the admin console under 'Administration > Login > OAuth 2.0'. Additionally, custom OIDC providers using 'OpenIdConnectFullConfigurableProvider' with implicit flow should also be disabled.
Metrics
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Mar 31, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/OpenOLAT/OpenOLAT/security/advisories/GHSA-v8vp-x4q4-2vch | [email protected] | MitigationVendor Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-287 | Improper Authentication | [email protected] |
| CWE-347 | Improper Verification of Cryptographic Signature | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| frentix openolat | >= 10.5.4, < 20.2.5 |
CPE
Remediation
| |
Change History
4 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| Apr 2, 2026 | Initial Analysis | [email protected] |
| Mar 30, 2026 | New CVE Received | [email protected] |