The Microsoft 365 and Microsoft Entra ID Plugins for Moodle provide Office 365 and Azure Active Directory integration for Moodle. Prior to 4.5.6, 5.0.5, and 5.1.1, the Microsoft Office 365 Integration plugin local_o365 Teams SSO endpoint sso_login.php base64-decodes a JWT payload and authenticates users from the upn claim without verifying the JWT signature, allowing an unauthenticated attacker to forge a token and obtain a Moodle session as an O365-authenticated user. This issue is fixed in versions 4.5.6, 5.0.5, and 5.1.1.

Attack Vector Network

Attack Complexity Low

Privileges Required None

Attack Requirements None

User Interaction None

Vulnerable System Confidentiality Impact High

Vulnerable System Integrity Impact High

Vulnerable System Availability Impact High

Subsequent System Confidentiality Impact None

Subsequent System Integrity Impact None

Subsequent System Availability Impact None

No CVSS v3.1

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

No EPSS score available.

Exploitation none

Automatable yes

Technical Impact total

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions
microsoft o365-moodle affected
Version Status Constraints
< 4.5.6 affected —
>= 5.0.0, < 5.0.5 affected —
>= 5.1.0, < 5.1.1 affected —

No data.

No data.

No data.

Project Subscriptions

No data.

Advisories

No advisories yet.

Fixes

Solution

No solution given by the vendor.

Workaround

No workaround given by the vendor.

References
Link Providers
https://github.com/microsoft/o365-moodle/commit/01b2d4c2e13b06a66557527084cbf9bace655944 cve-icon
https://github.com/microsoft/o365-moodle/commit/258872f6e2011f4efa8ebb77d2898142a9435e89 cve-icon
https://github.com/microsoft/o365-moodle/commit/d5596655f0baaee0f11aec2e10d6f36b0bd29220 cve-icon
https://github.com/microsoft/o365-moodle/releases/tag/v20260423_m405 cve-icon
https://github.com/microsoft/o365-moodle/releases/tag/v20260423_m500 cve-icon
https://github.com/microsoft/o365-moodle/releases/tag/v20260423_m501 cve-icon
https://github.com/microsoft/o365-moodle/security/advisories/GHSA-hqjh-93qv-47v5 cve-icon
History

Thu, 16 Jul 2026 16:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}

Thu, 16 Jul 2026 15:30:00 +0000

Type Values Removed Values Added
Description The Microsoft 365 and Microsoft Entra ID Plugins for Moodle provide Office 365 and Azure Active Directory integration for Moodle. Prior to 4.5.6, 5.0.5, and 5.1.1, the Microsoft Office 365 Integration plugin local_o365 Teams SSO endpoint sso_login.php base64-decodes a JWT payload and authenticates users from the upn claim without verifying the JWT signature, allowing an unauthenticated attacker to forge a token and obtain a Moodle session as an O365-authenticated user. This issue is fixed in versions 4.5.6, 5.0.5, and 5.1.1.
Title moodle-local_o365: Authentication bypass via unverified JWT signature in Teams SSO endpoint
Weaknesses CWE-347
References
Metrics cvssV4_0

{'score': 9.3, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N'}

Projects

Sign in to view the affected projects.

cve-icon MITRE

Status: PUBLISHED

Assigner: GitHub_M

Published:

Updated: 2026-07-16T15:35:02.951Z

Reserved: 2026-06-15T23:07:33.232Z

Link: CVE-2026-54733

cve-icon Vulnrichment

Updated: 2026-07-16T15:34:58.532Z

cve-icon NVD

No data.

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

No data.

Weaknesses