Which versions of PHP are affected by CVE-2026-54733?

A critical vulnerability in the Microsoft 365 integration plugin for Moodle allows unauthenticated attackers to forge authentication tokens and gain unauthorized access to any Office 365-linked user…. A patch is available.

How to fix or mitigate CVE-2026-54733?

Within 24 hours, identify all Moodle deployments running the local_o365 (Microsoft 365/Entra ID) plugin and determine which are running affected versions (Moodle 4.5.5 and earlier, 5.0.4 and earlier, or 5.1.0 and earlier). Within 7 days, apply the vendor patch by upgrading affected Moodle instances to versions 4.5.6, 5.0.5, or 5.1.1 or later according to your current version line. Within 30 days, complete patch deployment across all Moodle systems and verify user authentication flows are functional through the updated Microsoft 365 plugin.

PHP CVE-2026-54733

Q: What is the CVSS score of CVE-2026-54733?

CVE-2026-54733 has a CVSS 4.0 base score of 9.3 (Critical). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.9%.

EUVD-2026-44938 CRITICAL

Improper Verification of Cryptographic Signature (CWE-347)

2026-07-16 GitHub_M

PHP Information Disclosure Microsoft Jwt Attack O365 Moodle

9.3

CVSS 4.0 · Vendor: GitHub_M

Severity by source

Vendor (GitHub_M) PRIMARY

9.3 CRITICAL

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from Vendor (GitHub_M) · only source for this CVE.

CVSS VectorVendor: GitHub_M

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Patch available

Jul 16, 2026 - 17:03 EUVD

Source Code Evidence Fetched

Jul 16, 2026 - 15:53 vuln.today

Analysis Generated

Jul 16, 2026 - 15:53 vuln.today

CVE Published

Jul 16, 2026 - 14:52 cve.org

CRITICAL 9.3

DescriptionCVE.org

The Microsoft 365 and Microsoft Entra ID Plugins for Moodle provide Office 365 and Azure Active Directory integration for Moodle. Prior to 4.5.6, 5.0.5, and 5.1.1, the Microsoft Office 365 Integration plugin local_o365 Teams SSO endpoint sso_login.php base64-decodes a JWT payload and authenticates users from the upn claim without verifying the JWT signature, allowing an unauthenticated attacker to forge a token and obtain a Moodle session as an O365-authenticated user. This issue is fixed in versions 4.5.6, 5.0.5, and 5.1.1.

Articles & Coverage 1

News Critical Authentication Bypass in Moodle local_o365 Plugin - CVE-2026-54733 Jul 17, 2026

AnalysisAI

Authentication bypass in the Microsoft 365 / Microsoft Entra ID (local_o365) plugin for Moodle allows an unauthenticated attacker to forge a JWT and log in as any Office 365-linked Moodle user before versions 4.5.6, 5.0.5, and 5.1.1. The Teams SSO endpoint sso_login.php base64-decodes the JWT payload and trusts the 'upn' claim without verifying the token signature, so a self-signed or hand-crafted token is accepted as valid. There is no public exploit identified at time of analysis and it is not in CISA KEV, but the flaw is trivially exploitable and confirmed by a Microsoft GitHub security advisory (GHSA-hqjh-93qv-47v5).