CVE-2026-44720
📛 CVE Title
(no title)
Description
OpenLearnX: Critical Authentication Bypass via JWT Signature Verification Disabled Leading to Account Takeover
Overview
- State
- —
- Assigner (CNA)
- —
- CVSS severity
- critical
- CVSS score
- 9.8 / 10
- CVSS vector
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H- Effective score
- 9.8 / 10 CRITICAL source: CNA overview
- CWE(s)
- —
- Reserved
- —
- Published
- —
- Last updated
- —
- Source
- https://www.tenable.com/cve/CVE-2026-44720
- Linked Threat
- CVE-2026-44720 — CVE-2026-44720
NVD / KEV / EPSS data refreshed 2026-05-25 00:03 UTC. Re-run the 🛰 Backfill from NVD button above to refresh.
European Union Vulnerability Database ENISA EUVD
ENISA's official EU repository for curated vulnerability intelligence. Carries a separate identifier (EUVD-YYYY-NNNN) and frequently exposes an earlier-published description + CVSS than NVD does.
- EUVD ID
-
EUVD-2026-32669 - Assigner
- GitHub_M
- Published
- May 27, 2026, 9:02:29 PM
- Updated
- Jun 2, 2026, 6:09:07 PM
- EUVD base score (CVSS 4.0)
-
6.9 / 10
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N - EUVD-reported EPSS
- 0.2100
- Vendors
- th30d4y
- Products
-
OpenLearnX (< 2.0.4)
- Aliases
-
GHSA-223g-f5mq-gw33
ENISA description: OpenLearnX is an open-source, decentralized learning and assessment platform. Prior to 2.0.4, a critical authentication vulnerability was identified in OpenLearnX that could allow unauthorized access to user accounts under specific conditions. This vulnerability is fixed in 2.0.4.
EUVD references (1)
Vendor references (0)
References embedded in the original CVE record by the assigning CNA.
None in the CVE record.
Web references (4)
DuckDuckGo results ranked by threat-intel / vendor advisory domains. Generated by the 🔎 Find references (web) button above — same flow as the Remediations search.
- https://github.com/th30d4y/OpenLearnX/security/advisories/GHSA-223g-f5mq-gw33 tenable:github.com
- https://www.first.org/epss/ tenable:www.first.org
- https://nvd.nist.gov/vuln/detail/CVE-2026-44720 tenable:nvd.nist.gov
- https://www.cve.org/CVERecord?id=CVE-2026-44720 tenable:www.cve.org
Remediations (10)
Remediations are stored against the linked Threat row; the list below is deduplicated across both pages.
-
web:blackswan-cybersecurity.com
Cloud Files API activity originating outside legitimate OneDrive/sync processes. Mitigation Steps: Apply all Windows updates immediately (monitor MSRC for an emergency RedSun-specific patch . None released as of April 17, 2026 ). Supplement Defender with a secondary EDR solution (e.g., Huntress) capable of detecting Defender bypasses.
2026-05-26 02:53 UTC -
web:blog.qualys.com
Oracle released its second quarterly edition of this year's Critical Patch Update. The update received patches for 481 security vulnerabilities.
2026-05-26 02:53 UTC -
web:cyberpress.org
Oracle has released its January 2026 Critical Patch Update (CPU), delivering security patches for 337 vulnerabilities across multiple product families. Published through Oracle's Security Alerts portal, the advisory emphasizes the cumulative nature of these patches and strongly recommends immediate deployment across enterprise environments to mitigate active exploitation attempts. Critical ...
2026-05-26 02:53 UTC -
web:integsec.com
CVE‑2026‑44277 is a critical‑severity vulnerability in Fortinet's FortiAuthenticator identity‑and‑access‑management platform that allows an unauthenticated attacker to execute arbitrary code or commands on the appliance. This single vulnerability can put your corporate identity store, authentication flows, and downstream business systems into an attacker's hands, making it a ...
2026-05-26 02:53 UTC -
web:msrc.microsoft.com
The Microsoft Security Response Center (MSRC) investigates all reports of security vulnerabilities affecting Microsoft products and services, and provides the information here as part of the ongoing effort to help you manage security risks and help keep your systems protected.
2026-05-26 02:53 UTC -
web:www.bleepingcomputer.com
Today is Microsoft's April 2026 Patch Tuesday with security updates for 167 flaws, including 2 zero-day vulnerabilities.
2026-05-26 02:53 UTC -
web:www.oracle.com
This Critical Patch Update contains 481 new security patches across the product families listed below. Please note that an MOS note summarizing the content of this Critical Patch Update and other Oracle Software Security Assurance activities is located at April 2026 Critical Patch Update: Executive Summary and Analysis.
2026-05-26 02:53 UTC -
web:www.securityweek.com
Oracle on Tuesday announced the release of 481 new security patches as part of its April 2026 Critical Patch Update (CPU). Across the 28 product families that received security updates, more than 300 patches address vulnerabilities that are remotely exploitable without authentication.
2026-05-26 02:53 UTC -
web:www.tenable.com
Oracle addresses 241 CVEs in its April Critical Patch Update, the second quarterly update of 2026 with 481 patches, including 34 critical updates.
2026-05-26 02:53 UTC -
web:zecurit.com
Get the complete breakdown of Microsoft's May 2026 Patch Tuesday. We analyze the latest security updates and all critical CVEs .
2026-05-26 02:53 UTC
AI Forensic Analysis
Only Available for Registered Users. Sign in to view.