CVE-2026-54733

Name of the Vulnerable Software and Affected Versions Microsoft Office 365 Integration plugin versions prior to 4.5.6 Microsoft Office 365 Integration plugin versions prior to 5.0.5 Microsoft Office 365 Integration plugin versions prior to 5.1.1

Description The Microsoft Office 365 Integration plugin for Moodle fails to verify the JWT (JSON Web Token) signature when processing the sso login.php endpoint. An unauthenticated attacker can base64-decode a JWT payload and forge a token using the upn claim to obtain a Moodle session as an authenticated Office 365 user.

Recommendations Update to version 4.5.6. Update to version 5.0.5. Update to version 5.1.1.