Openolat - Openolat - CRITICAL - CVE-2026-31946. OpenOLAT, an open source web-based e-learning platform, has a vulnerability in its OpenID Connect implementation. Specifically, versions from 10.5.4 to before 20.2.5 fail to verify JSON Web Token (JWT) signatures adequately. This flaw arises because the JSONWebToken.parse() method neglects to validate the signature segment of the compact JWT format. As a result, the access token retrieval methods in OpenIdConnectApi and OpenIdConnectFullConfigurableApi only check claim-level fields, such as issuer and audience, without performing necessary cryptographic signature validation against the provided Identity Provider's JWKS endpoint. This oversight could lead to unauthorized access and potential data breaches within the platform. The vulnerability has been addressed in version 20.2.5.