OpenOLAT versions 10.5.4 through just before 20.2.5 implement the OpenID Connect implicit flow without verifying JWT signatures. The JWT parsing routine silently removes the signature segment, and the token validation functions only check claim-level fields such as issuer, audience, state, and nonce. Consequently an attacker can forge a JWT and use it to bypass authentication, gaining unauthorized access to the platform, its courses, assessment data, and potentially personal user information.

The vulnerability affects installations of OpenOLAT covered on the path OpenOLAT:OpenOLAT, specifically from release 10.5.4 up to but not including version 20.2.5. Any deployment of those release candidates using the default OIDC implicit flow is susceptible.

The CVSS score of 9.8 indicates critical severity, with a high likelihood that a remote attacker can exploit it via the web interface by crafting and submitting a forged JWT. While EPSS data is not available, the absence of the vulnerability in the KEV catalog does not mitigate the high risk presented by the lack of signature verification. Attackers can simply redirect users to a malicious OIDC flow, submitting a forged token that the server accepts and thus impersonate any user without any local system compromise.