OpenLearnX: Critical Authentication Bypass via JWT Signature Verification Disabled Leading to Account Takeover
Priority LOW 36CWE-287Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Attack requirements
- None
- Impact type
- Security bypass
- Confidentiality · integrity · availability
- None · Low · None
- Fix status
- Fixed
Attack profile from CVSS 4.0 · CNA. Fix status from CNA and GitHub. Impact type from CWE-287.
Summary
OpenLearnX is an open-source, decentralized learning and assessment platform. Prior to 2.0.4, a critical authentication vulnerability was identified in OpenLearnX that could allow unauthorized access to user accounts under specific conditions. This vulnerability is fixed in 2.0.4.
Why it matters now
Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00207 10th percentileScored 2026-11-07
Fix Fixed OpenLearnX (th30d4y): 2.0.4openlearnx (npm): 2.0.4
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- Yes
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| th30d4y | OpenLearnX | before 2.0.4 | 2.0.4 | Patch available | CNA |
| — | openlearnx (npm) | before 2.0.4 | 2.0.4 | Patch available | GHSA-223g-f5mq-gw33 |
- OpenLearnX Vendorth30d4y Affected before 2.0.4 Fixed in 2.0.4 Patch available CNA
- openlearnx (npm) Vendor— Affected before 2.0.4 Fixed in 2.0.4 Patch available GHSA-223g-f5mq-gw33
Remediation
- Fix · CNA OpenLearnX (th30d4y) Fixed in 2.0.4
- Fix · GHSA-223g-f5mq-gw33 openlearnx (npm) Fixed in 2.0.4 Advisory →
Timeline
- 2026-10-02 Threatist record created from CVE-2026-44720
- 2026-10-03 Alias added: GHSA-223g-f5mq-gw33
References
More th30d4y vulnerabilities
- TI-2026-30302 OpenLearnX has Critical Remote Code Execution Through Python Sandbox Escape via Code Execution Environment CVSS 3.1CRITICAL 10.0
- TI-2026-30130 th30d4y/IP: DOM-Based Cross-Site Scripting (XSS) Vulnerability CVSS 3.1MEDIUM 6.1
Sources
- CVE-2026-44720 · CVE Program
- CVE-2026-44720 · NVD
- FIRST EPSS
- GHSA-223g-f5mq-gw33 · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences