OpenLearnX has a critical authentication vulnerability that disables JWT signature verification, allowing attackers to craft forged tokens and impersonate users. According to the relevant CWEs, this issue represents a flaw in Authentication Management (CWE-287) and a flaw in improper cryptographic validation (CWE-347). This flaw can result in unauthorized account takeover and full access to the platform’s data and functionality. The lack of signature validation breaks the fundamental security assumption that tokens are trustworthy, enabling complete compromise of user accounts.

The vulnerability affects all installations of OpenLearnX prior to version 2.0.4. Versions 2.0.4 and later contain a fix that re‑enables proper JWT verification. No other products or vendors are listed as impacted.

The CVSS score of 6.9 indicates a high severity level. No EPSS score is available, so the probability of exploitation at this time is unknown. The vulnerability is not listed in CISA’s KEV catalog. Attackers can exploit it via crafted JWTs submitted to the authentication endpoint; no additional authentication is required. The flaw can be leveraged from any network location that can reach the affected instance.