OpenOLAT’s OpenID Connect implicit flow implementation fails to verify JWT signatures. The JSONWebToken.parse() method discards the signature segment of the compact JWT, and the token validation methods in OpenIdConnectApi and OpenIdConnectFullConfigurableApi only confirm claim‑level fields such as issuer, audience, state, and nonce without performing cryptographic signature verification against the Identity Provider’s JWKS endpoint. This flaw enables an attacker to supply a forged JWT that passes the claim checks and obtain an access token that authenticates as any user, effectively bypassing authentication.

OpenOLAT installations distributed by Frentix with versions ranging from 10.5.4 up to but not including 20.2.5 are affected. The vulnerability was addressed in version 20.2.5 when proper JWT signature verification was restored.

The CVSS score of 9.8 denotes critical severity, while the EPSS score of less than 1% suggests a low probability of current exploitation. The vulnerability is not listed in the CISA KEV catalog, indicating no publicly known exploits at present. The likely attack vector is the OIDC implicit flow, where an attacker can supply a forged token without needing additional privileges to bypass authentication.