th30d4y/openlearnx · Security
OpenLearnX: Critical Authentication Bypass via JWT Signature Verification Disabled Leading to Account Takeover
- GHSA ID
- GHSA-223g-f5mq-gw33
- CVE ID
- CVE-2026-44720
- Severity
- medium
- Published
- Updated
- CVSS v4
- 6.9 · CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N
Description
Overview
A critical authentication vulnerability was identified in OpenLearnX that could allow unauthorized access to user accounts under specific conditions. The issue has been fixed.
Advisory: https://github.com/th30d4y/OpenLearnX/security/advisories/GHSA-223g-f5mq-gw33
CWEs
- CWE-287 · Improper Authentication
- CWE-347 · Improper Verification of Cryptographic Signature