The vulnerability in Microsoft 365 and Microsoft Entra ID Plugins for Moodle (o365-moodle) arises from improper verification of cryptographic signatures (CWE-347) in the Teams SSO endpoint sso_login.php. Specifically, the plugin base64-decodes the JWT payload and authenticates users solely based on the upn claim without validating the JWT signature. This flaw enables unauthenticated attackers to forge tokens and impersonate Office 365 authenticated users within Moodle. The vulnerability affects versions prior to 4.5.6, 5.0.5, and 5.1.1 and has a CVSS 4.0 score of 9.3 (critical). The vulnerability is present in the plugin code, not in a cloud service component. Patches are available in the fixed versions.

An attacker can bypass authentication by forging JWT tokens without a valid cryptographic signature, allowing unauthorized access to Moodle sessions as legitimate Office 365 users. This leads to a complete compromise of user accounts within Moodle integrated with Microsoft 365 and Azure Active Directory via the vulnerable plugin versions. The vulnerability is critical due to its ease of exploitation (no privileges or user interaction required) and high impact on confidentiality, integrity, and availability.

A fix is available in Microsoft 365 and Microsoft Entra ID Plugins for Moodle versions 4.5.6, 5.0.5, and 5.1.1. Users should upgrade to one of these versions immediately to remediate the vulnerability. Since this is a plugin vulnerability, patching the affected Moodle plugin installations is necessary. There is no indication that the vendor manages remediation server-side for this plugin, so manual update is required. Patch status is confirmed by the vendor advisory information.