Skip to content

Critical Authentication Bypass via JWT Signature Verification Disabled Leading to Account Takeover

Moderate
0x5t4l1n published GHSA-223g-f5mq-gw33 May 8, 2026

Package

npm openlearnx (npm)

Affected versions

<2.0.3

Patched versions

>=2.0.4

Description

Overview

A critical authentication vulnerability was identified in OpenLearnX that could allow unauthorized access to user accounts under specific conditions. The issue has been fixed.

Advisory: GHSA-223g-f5mq-gw33

Severity

Moderate

CVE ID

CVE-2026-44720

Weaknesses

Improper Authentication

When an actor claims to have a given identity, the product does not prove or insufficiently proves that the claim is correct. Learn more on MITRE.

Improper Verification of Cryptographic Signature

The product does not verify, or incorrectly verifies, the cryptographic signature for data. Learn more on MITRE.

Credits