SB20260427107 - Multiple vulnerabilities in OpenOlat

Description

This security bulletin contains information about 2 vulnerabilities.

1) Improper Verification of Cryptographic Signature (CVE-ID: CVE-2026-31946)

CWE-ID: CWE-347 - Improper Verification of Cryptographic Signature

CVSSv4: 9.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to bypass authentication and obtain an authenticated session as any user.

The vulnerability exists due to improper verification of cryptographic signature in the OIDC implicit flow implementation when handling JWTs returned to the /oauthcallback endpoint. A remote attacker can construct and submit a forged JWT with an arbitrary sub claim to bypass authentication and obtain an authenticated session as any user.

Only installations with OIDC implicit flow enabled are vulnerable. The issue does not affect installations that do not use OAuth or that use only the authorization code flow.

2) Improper Neutralization of Special Elements Used in a Template Engine (CVE-ID: CVE-2026-28228)

CWE-ID: CWE-1336 - Improper Neutralization of Special Elements Used in a Template Engine

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote user to execute arbitrary code.

The vulnerability exists due to server-side template injection in VelocityEngine.evaluate() when processing user-controlled Velocity templates in reminder emails and other templated content. A remote user can inject crafted Velocity directives to execute arbitrary code.

Exploitation requires privileges associated with the Author role, and the injected template is evaluated when the reminder is processed manually or by the daily cron job.

Remediation

Install update from vendor's website.

References

• https://github.com/OpenOLAT/OpenOLAT/security/advisories/GHSA-v8vp-x4q4-2vch
• https://github.com/OpenOLAT/OpenOLAT/security/advisories/GHSA-55qg-vvgj-ffh4