The Microsoft 365 and Microsoft Entra ID integration plugin for Moodle contains a flaw in the Teams SSO login endpoint that decodes a JWT payload and trusts the UPN claim without verifying the token’s signature. An unauthenticated attacker can forge a signed‑by‑no‑one token, making the Moodle session as if the user had authenticated through Office 365. This flaw permits remote impersonation of any user in the integrated domain and undermines the integrity of authenticated sessions.

Any Moodle installation that uses the Microsoft 365 integration plug‑in "local_o365" at a version earlier than 4.5.6, 5.0.5, or 5.1.1 is vulnerable. These are the vulnerable releases documented by Microsoft in the plugin’s release notes and security advisories. The plugin provides Office 365 and Azure Active Directory integration for Moodle and is maintained by Microsoft.

The CVSS base score of 9.3 classifies this issue as critical, reflecting a remote authentication bypass that could allow full access to the Moodle site. The EPSS score is < 1%, indicating a low but non‑zero probability of exploitation, yet the absence of JWT signature verification makes exploitation trivial for an attacker who can craft a token. The vulnerability is not listed in the CISA KEV catalog, indicating no publicly known widespread exploitation at the time of this advisory. An attacker could target the Teams SSO endpoint with a forged token, which the vulnerable system will accept and use to create a session for the claimed user, thereby enabling potential data theft, credential misuse, and lateral movement within the Moodle environment.