Executive brief
A security vulnerability exists in the Microsoft 365 integration plugin for Moodle, a popular learning management system. The plugin fails to properly verify security tokens during the Microsoft Teams single sign-on (SSO) process. This allows an unauthorized attacker to impersonate any user and gain full access to their Moodle account and data without needing a password.
Technical details
The Microsoft Office 365 Integration plugin for Moodle (local_o365) contains an authentication bypass vulnerability in its Teams SSO endpoint (sso_login.php). The component base64-decodes the JSON Web Token (JWT) payload and authenticates users based on the 'upn' claim without verifying the cryptographic signature of the token (CWE-347). A remote, unauthenticated attacker can exploit this by forging a JWT with a target user's UPN to obtain a valid Moodle session. The issue is resolved in versions 4.5.6, 5.0.5, and 5.1.1 by implementing proper signature validation using JWKS.
Affected products
- Microsoft o365-moodle (Microsoft 365 Integration) < 4.5.6, >= 5.0.0 < 5.0.5, >= 5.1.0 < 5.1.1
Timeline
- 2026-07-16: advisory
- 2026-07-16: disclosed
- 2026-03-12: patched
References
- https://github.com/microsoft/o365-moodle/commit/01b2d4c2e13b06a66557527084cbf9bace655944
- https://github.com/microsoft/o365-moodle/commit/258872f6e2011f4efa8ebb77d2898142a9435e89
- https://github.com/microsoft/o365-moodle/commit/d5596655f0baaee0f11aec2e10d6f36b0bd29220
- https://github.com/microsoft/o365-moodle/releases/tag/v20260423_m405
- https://github.com/microsoft/o365-moodle/releases/tag/v20260423_m500
- https://github.com/microsoft/o365-moodle/releases/tag/v20260423_m501
- https://github.com/microsoft/o365-moodle/security/advisories/GHSA-hqjh-93qv-47v5