---
schema: 1
kind: vulnerability
title: "Moodle local_o365 plugin: unverified JWT signature on the Teams SSO endpoint lets anyone authenticate as any user (CVE-2026-54733)"
headline: "The official Microsoft 365 integration for Moodle authenticated forged JWTs — knowing a user's email was enough for full site takeover; patch 4.5.6/5.0.5/5.1.1"
summary: >
  CVE-2026-54733 in local_o365, the official Microsoft 365 / Entra ID integration plugin for
  Moodle, lets an unauthenticated attacker forge a JWT for the Teams SSO endpoint sso_login.php:
  the code authenticated users from the token's upn claim without ever verifying the JWT
  signature, so knowing or enumerating any user's email address — an administrator's included —
  yields that user's session and "effectively full site takeover". Fixed in 4.5.6, 5.0.5 and
  5.1.1; CVSS 4.0 9.3 (GitHub CNA); no exploitation reported. Relevant to the wider European
  public sector: Moodle is the dominant LMS across education and public-sector training. The fix shipped in April 2026 releases and the vendor advisory published 2026-07-06;
  BSI CERT-Bund surfaced it in-window (2026-07-16/17) and the daily fires swept BSI and passed over it,
  so it is recovered here.
discovered_at: "2026-07-18T13:30:00Z"
event_date: "2026-07-06"
run_id: 2026-07-18T1208Z-audit
priority: notable
immediate_action: null
tags: [vulnerabilities, identity, auth-bypass, pre-auth, patch-available]
regions: [global, europe]
sectors: [public-sector]
entities: []
techniques: [T1190, T1606, T1078]
affected_products: ["Moodle local_o365 plugin (Microsoft Office 365 Integration for Moodle)"]
cves:
  - id: CVE-2026-54733
    cvss: "9.3"
    epss: null
    type: auth-bypass
    vector: zero-click
    auth: pre-auth
    status: [patch-available]
    affected: "local_o365 before 4.5.6; 5.0.0–5.0.4; 5.1.0 (Teams SSO endpoint sso_login.php)"
    fixed: "local_o365 4.5.6 / 5.0.5 / 5.1.1"
sources:
  - url: "https://github.com/microsoft/o365-moodle/security/advisories/GHSA-hqjh-93qv-47v5"
    publisher: "Microsoft o365-moodle GitHub Security Advisory"
    date: "2026-07-06"
    role: primary
  - url: "https://wid.cert-bund.de/portal/wid/securityadvisory?name=WID-SEC-2026-2400"
    publisher: "BSI CERT-Bund"
    date: "2026-07-16"
    role: corroborating
closed_sources: []
evidence:
  - quote: "The signature component was extracted but never verified. Authentication proceeded solely on the upn claim value in the unvalidated payload."
    publisher: "Microsoft o365-moodle GitHub Security Advisory"
  - quote: "An unauthenticated remote attacker who knows (or can enumerate) any O365-authenticated user's email address can forge a JWT with an arbitrary upn claim."
    publisher: "Microsoft o365-moodle GitHub Security Advisory"
  - quote: "Ein entfernter, anonymer Angreifer kann eine Schwachstelle in Microsoft Office 365 (Moodle Plugin) ausnutzen, um Sicherheitsvorkehrungen zu umgehen, Benutzer zu imitieren und sich so erweiterte Berechtigungen, einschließlich Administratorzugriff, zu verschaffen."
    publisher: "BSI CERT-Bund"
verification: single-source
sourcing_note: "The primary is the vendor's own GitHub security advisory (Microsoft's o365-moodle repository — first-party for its own plugin); BSI CERT-Bund's WID-SEC-2026-2400 (severity 'hoch') independently judged it advisory-worthy but derives its facts from the same advisory, so this is carried as single-source rather than multi-source. CVSS 4.0 9.3 is assigned by the GitHub CNA; BSI assigns no numeric score. No exploitation is reported by any fetched source. Dates: the fixed plugin versions are tagged 2026-04-23, the GitHub advisory page shows a publication date of 2026-07-06, and the OSV mirror records a 2026-07-16 ingestion timestamp for the same GHSA; event_date records the 07-06 vendor-advisory date. This is an audit-recovered out-of-window primary whose recency anchor is BSI CERT-Bund's in-window advisory WID-SEC-2026-2400 (2026-07-16/17), which the daily fires swept and missed."
confidence: medium
update_of: null
references: []
deep_dive: false
deep_dive_category: null
org_triage: null
classification:
  reliability: A
  credibility: 2
watchlist_hit: false
actions: []
migrated_from: null
---

BSI CERT-Bund's advisory WID-SEC-2026-2400 (severity "hoch") surfaced CVE-2026-54733 in **local_o365**, the official Microsoft 365 / Entra ID integration plugin for Moodle, disclosed through Microsoft's own repository advisory published 2026-07-06 ([GitHub Security Advisory, 2026-07-06](https://github.com/microsoft/o365-moodle/security/advisories/GHSA-hqjh-93qv-47v5)) and surfaced in-window by BSI CERT-Bund's advisory WID-SEC-2026-2400 (2026-07-16/17, [BSI CERT-Bund, 2026-07-16](https://wid.cert-bund.de/portal/wid/securityadvisory?name=WID-SEC-2026-2400)). The flaw (CWE-347, improper verification of cryptographic signature) sits in `sso_login.php`, the plugin's Microsoft Teams single-sign-on endpoint: the code base64-decoded an incoming JWT and authenticated the user from its `upn` (user principal name) claim alone — "the signature component was extracted but never verified. Authentication proceeded solely on the upn claim value in the unvalidated payload" ([GitHub Security Advisory, 2026-07-06](https://github.com/microsoft/o365-moodle/security/advisories/GHSA-hqjh-93qv-47v5)). The consequence is a pre-auth impersonation primitive: "an unauthenticated remote attacker who knows (or can enumerate) any O365-authenticated user's email address can forge a JWT with an arbitrary upn claim" and be logged in as that user — a site administrator included, which the advisory summarizes as effectively full site takeover. Institutional address books make the prerequisite trivial: most UPNs follow guessable naming conventions. Fixed in plugin versions 4.5.6, 5.0.5 and 5.1.1; the GitHub CNA scores it CVSS 4.0 9.3 ([GitHub Security Advisory, 2026-07-06](https://github.com/microsoft/o365-moodle/security/advisories/GHSA-hqjh-93qv-47v5)). No in-the-wild exploitation is reported by any fetched source.

**Defender takeaway:** this matters to the European education and public-sector-training estate, where Moodle paired with Microsoft 365 SSO is a default stack — the affected component is the bridge between the LMS and the institutional identity plane, and the bug converts email-address knowledge into admin capability on the LMS. Patch the plugin out of band of the normal Moodle release cadence (the fix is in the plugin, not Moodle core). Detection is workable because forged logins skip the real identity provider: in combined web and identity telemetry, a Moodle session established via `sso_login.php` for which Entra ID sign-in logs show **no corresponding token issuance** for that user at that time is the direct signal; retrospective hunting over that join since the plugin's installation window is the honest scope, since forgery leaves no IdP-side trace at all. Privilege changes, new enrolments, or web-service token creation by admin accounts shortly after such an orphan SSO login are the escalation markers.