CVE-2026-44720CWE-287CWE-347

OpenLearnX: Critical Authentication Bypass via JWT Signature Verification Disabled Leading to Account Takeover

Medium · published May 27, 2026

CVSS v4.0
6.9
EPSS
0%
Percentile
25.6
In the wild
Unconfirmed
What it is

OpenLearnX is an open-source, decentralized learning and assessment platform. Prior to 2.0.4, a critical authentication vulnerability was identified in OpenLearnX that could allow unauthorized access to user accounts under specific conditions. This vulnerability is fixed in 2.0.4.

The record
Technical detail
CVSS v4.0
6.9 · MEDIUM
Vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N
EPSS
0.00335 · 25.6th percentile
Weaknesses
CWE-287 · Improper Authentication; CWE-347 · Improper Verification of Cryptographic Signature
Published
2026-05-27T21:02Z
EPSS history
Timeline
  • 27 MAY 21:02Z
    OpenLearnX: Critical Authentication Bypass via JWT Signature Verification Disabled Leading to Account Takeover
    cvelistv5