CVE-2026-54733 json
moodle-local_o365: Authentication bypass via unverified JWT signature in Teams SSO endpoint
published 3mo ago modified 18d ago also EUVD-2026-44938
- cvss
- 9.3
- version 4.0, CNA
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 0.9%
- EPSS 0.9% chance of exploitation in 30 days, percentile 59%
- public exploits
- 0
- none known
Summary
The Microsoft 365 and Microsoft Entra ID Plugins for Moodle provide Office 365 and Azure Active Directory integration for Moodle. Prior to 4.5.6, 5.0.5, and 5.1.1, the Microsoft Office 365 Integration plugin local_o365 Teams SSO endpoint sso_login.php base64-decodes a JWT payload and authenticates users from the upn claim without verifying the JWT signature, allowing an unauthenticated attacker to forge a token and obtain a Moodle session as an O365-authenticated user. This issue is fixed in versions 4.5.6, 5.0.5, and 5.1.1.
Patch / fix
- github.com/microsoft/o365-moodle@01b2d4c commit
- github.com/microsoft/o365-moodle@258872f commit
- github.com/microsoft/o365-moodle@d559665 commit
- github.com/microsoft/o365-moodle/releases/tag/v20260423_m405 release
- github.com/microsoft/o365-moodle/releases/tag/v20260423_m500 release
- github.com/microsoft/o365-moodle/releases/tag/v20260423_m501 release
Is CVE-2026-54733 in your stack? Fencer shows which of your repositories are affected as soon as an advisory lands, and opens the fix as a pull request.
Check with FencerCISA SSVC
- Exploitation
- none
- Automatable
- yes
- Technical impact
- total
- Assessed
- 3mo ago
Exploit prediction
0.88% chance of exploitation in the next 30 days, higher than 59% of all scored CVEs (FIRST EPSS, 2026-11-11).
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CNA | 4.0 | 9.3 | CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N |
| CNA | 4.0 | 9.3 | CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X |
Affected products
- microsoft o365-moodle
Classification
- Weakness
-
- CWE-347 Improper Verification of Cryptographic Signature
References
- github.com /microsoft/o365-moodle/commit/01b2d4c2e13b06a66557527084cbf9bace655944
- github.com /microsoft/o365-moodle/commit/258872f6e2011f4efa8ebb77d2898142a9435e89
- github.com /microsoft/o365-moodle/commit/d5596655f0baaee0f11aec2e10d6f36b0bd29220
- github.com /microsoft/o365-moodle/security/advisories/GHSA-hqjh-93qv-47v5
- github.com /microsoft/o365-moodle/releases/tag/v20260423_m405
- github.com /microsoft/o365-moodle/releases/tag/v20260423_m500
- github.com /microsoft/o365-moodle/releases/tag/v20260423_m501
Sources
- CVE List CVE-2026-54733
- NVD CVE-2026-54733
Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.