MEDIUM

GHSA-223g-f5mq-gw33

OpenLearnX: Critical Authentication Bypass via JWT Signature Verification Disabled Leading to Account Takeover

Quick fix

GHSA-223g-f5mq-gw33 — openlearnx: upgrade to the fixed version with the command below.

npm install openlearnx@2.0.4

Details

### Overview

A critical authentication vulnerability was identified in OpenLearnX that could allow unauthorized access to user accounts under specific conditions. The issue has been fixed.

**Advisory**: https://github.com/th30d4y/OpenLearnX/security/advisories/GHSA-223g-f5mq-gw33

Are you affected?

Enter the version of the package you're using.

Affected packages

npm/openlearnx

Introduced in: 0Fixed in: 2.0.4

Fixnpm install openlearnx@2.0.4

References

https://github.com/th30d4y/OpenLearnX/security/advisories/GHSA-223g-f5mq-gw33[WEB]
https://nvd.nist.gov/vuln/detail/CVE-2026-44720[ADVISORY]
https://github.com/th30d4y/OpenLearnX[PACKAGE]
https://github.com/th30d4y/OpenLearnX/releases/tag/v2.0.4[WEB]