CVE-2026-54733 json
moodle-local_o365: Authentication bypass via unverified JWT signature in Teams SSO endpoint
published 2026-07-16 3 mo ago modified 2026-10-24 15 d ago also EUVD-2026-44938
- cvss
- 9.3
- version 4.0, CNA
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 0.9%
- EPSS 0.9% chance of exploitation in 30 days, percentile 59%
- public exploits
- 0
- none known
Summary
The Microsoft 365 and Microsoft Entra ID Plugins for Moodle provide Office 365 and Azure Active Directory integration for Moodle. Prior to 4.5.6, 5.0.5, and 5.1.1, the Microsoft Office 365 Integration plugin local_o365 Teams SSO endpoint sso_login.php base64-decodes a JWT payload and authenticates users from the upn claim without verifying the JWT signature, allowing an unauthenticated attacker to forge a token and obtain a Moodle session as an O365-authenticated user. This issue is fixed in versions 4.5.6, 5.0.5, and 5.1.1.
Patch / fix
- github.com/microsoft/o365-moodle@01b2d4c commit
- github.com/microsoft/o365-moodle@258872f commit
- github.com/microsoft/o365-moodle@d559665 commit
- github.com/microsoft/o365-moodle/releases/tag/v20260423_m405 release
- github.com/microsoft/o365-moodle/releases/tag/v20260423_m500 release
- github.com/microsoft/o365-moodle/releases/tag/v20260423_m501 release
CISA SSVC
- Exploitation
- none
- Automatable
- yes
- Technical impact
- total
- Assessed
- 3 mo ago
Exploit prediction
0.88% chance of exploitation in the next 30 days, higher than 59% of all scored CVEs (FIRST EPSS, 2026-11-08).
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CNA | 4.0 | 9.3 | CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N |
| CNA | 4.0 | 9.3 | CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X |
Affected products
- microsoft o365-moodle
Classification
- Weakness
-
- CWE-347 Improper Verification of Cryptographic Signature
References
- github.com /microsoft/o365-moodle/commit/01b2d4c2e13b06a66557527084cbf9bace655944
- github.com /microsoft/o365-moodle/commit/258872f6e2011f4efa8ebb77d2898142a9435e89
- github.com /microsoft/o365-moodle/commit/d5596655f0baaee0f11aec2e10d6f36b0bd29220
- github.com /microsoft/o365-moodle/security/advisories/GHSA-hqjh-93qv-47v5
- github.com /microsoft/o365-moodle/releases/tag/v20260423_m405
- github.com /microsoft/o365-moodle/releases/tag/v20260423_m500
- github.com /microsoft/o365-moodle/releases/tag/v20260423_m501
Sources
- CVE List CVE-2026-54733
- NVD CVE-2026-54733
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.