OpenLearnX is an open-source, decentralized learning and assessment platform. Prior to 2.0.4, a critical authentication vulnerability was identified in OpenLearnX that could allow unauthorized access to user accounts under specific conditions. This vulnerability is fixed in 2.0.4.
PUBLISHED5.2CWE-287CWE-347
OpenLearnX: Critical Authentication Bypass via JWT Signature Verification Disabled Leading to Account Takeover
Problem type
Affected products
th30d4y
OpenLearnX
< 2.0.4 - AFFECTED
References
GitHub Security Advisories
GHSA-223g-f5mq-gw33
OpenLearnX: Critical Authentication Bypass via JWT Signature Verification Disabled Leading to Account Takeover
https://github.com/advisories/GHSA-223g-f5mq-gw33Overview
A critical authentication vulnerability was identified in OpenLearnX that could allow unauthorized access to user accounts under specific conditions. The issue has been fixed.
Advisory: https://github.com/th30d4y/OpenLearnX/security/advisories/GHSA-223g-f5mq-gw33
JSON source
https://cveawg.mitre.org/api/cve/CVE-2026-44720Click to expand
{
"dataType": "CVE_RECORD",
"dataVersion": "5.2",
"cveMetadata": {
"cveId": "CVE-2026-44720",
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"dateUpdated": "2026-05-27T21:02:29.706Z",
"dateReserved": "2026-05-07T18:04:17.308Z",
"datePublished": "2026-05-27T21:02:29.706Z",
"state": "PUBLISHED"
},
"containers": {
"cna": {
"providerMetadata": {
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M",
"dateUpdated": "2026-05-27T21:02:29.706Z"
},
"title": "OpenLearnX: Critical Authentication Bypass via JWT Signature Verification Disabled Leading to Account Takeover",
"descriptions": [
{
"lang": "en",
"value": "OpenLearnX is an open-source, decentralized learning and assessment platform. Prior to 2.0.4, a critical authentication vulnerability was identified in OpenLearnX that could allow unauthorized access to user accounts under specific conditions. This vulnerability is fixed in 2.0.4."
}
],
"affected": [
{
"vendor": "th30d4y",
"product": "OpenLearnX",
"versions": [
{
"version": "< 2.0.4",
"status": "affected"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"lang": "en",
"description": "CWE-287: Improper Authentication",
"cweId": "CWE-287",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"lang": "en",
"description": "CWE-347: Improper Verification of Cryptographic Signature",
"cweId": "CWE-347",
"type": "CWE"
}
]
}
],
"references": [
{
"url": "https://github.com/th30d4y/OpenLearnX/security/advisories/GHSA-223g-f5mq-gw33",
"name": "https://github.com/th30d4y/OpenLearnX/security/advisories/GHSA-223g-f5mq-gw33",
"tags": [
"x_refsource_CONFIRM"
]
}
],
"metrics": [
{}
]
}
}
}