CVE-2026-42163: Mahara LTI Auth Bypass Vulnerability

CVE-2026-42163 Overview

CVE-2026-42163 is a broken access control vulnerability [CWE-284] in Mahara, an open-source ePortfolio and social networking platform. Versions prior to 25.04.5 and 26.04.0 allow unauthorized access to internal accounts through the Learning Tools Interoperability (LTI) integration. The flaw affects both LTI 1.1 and LTI 1.3 Advantage under certain configurations. An unauthenticated network-based attacker can obtain access to accounts that should not be reachable through the LTI launch flow.

Critical Impact
Unauthenticated attackers can access internal Mahara accounts via LTI launches, exposing confidentiality, integrity, and availability of user portfolios and associated data.

Affected Products

Mahara versions prior to 25.04.5
Mahara versions prior to 26.04.0
Deployments using LTI 1.1 or LTI 1.3 Advantage integrations

Discovery Timeline

2026-08-17 - CVE-2026-42163 published to NVD
2026-08-18 - Last updated in NVD database

Technical Details for CVE-2026-42163

Vulnerability Analysis

Mahara integrates with Learning Management Systems (LMS) using the IMS Global Learning Tools Interoperability (LTI) specification. LTI enables a tool consumer, such as Moodle or Canvas, to launch external tools like Mahara and pass user identity through a signed request. When the LTI launch flow fails to correctly bind incoming launch parameters to the expected internal Mahara account, an external LTI consumer can request access to accounts that were not intended to be reachable through that trust boundary.

The vulnerability applies to both LTI 1.1, which uses OAuth 1.0a signing with a shared secret, and LTI 1.3 Advantage, which uses signed JSON Web Tokens (JWT). Successful exploitation yields unauthorized access to internal user accounts, including portfolios, private artefacts, and messaging data managed by the affected account.

Root Cause

The root cause is improper access control in the LTI account resolution logic. Mahara mapped LTI launch identifiers to internal accounts without adequately enforcing the constraints that separate externally launchable accounts from internal-only accounts. This falls under [CWE-284: Improper Access Control].

Attack Vector

The attack requires network access to the Mahara LTI endpoint and an LTI consumer trust relationship, or the ability to craft launch parameters accepted by the target. No prior authentication or user interaction is needed. After a crafted LTI launch, the attacker is placed into the session of an internal account and inherits its privileges within Mahara.

No verified public exploit code is available. See the Mahara Forum Discussion for vendor context.

Detection Methods for CVE-2026-42163

Indicators of Compromise

LTI launch requests to /webservice/rest/server.php or /lti/ endpoints resolving to administrative or internal accounts that do not normally receive LTI launches.
Session creation events for internal accounts immediately following an LTI launch from an external consumer.
Unexpected successful authentications tied to LTI consumer keys or client_id values not associated with production LMS integrations.

Detection Strategies

Review Mahara authentication and event logs for LTI-initiated logins into accounts that lack an LTI role assignment.
Correlate LTI launch source IP addresses and consumer keys against the approved list of tool consumers.
Alert on privilege escalations or profile changes that occur within minutes of an LTI launch event.

Monitoring Recommendations

Forward Mahara web server and application logs to a centralized analytics platform for longitudinal review.
Track the volume of LTI 1.1 and LTI 1.3 launches per consumer to identify anomalous spikes.
Monitor for changes to LTI configuration tables and shared secrets outside of scheduled maintenance windows.

How to Mitigate CVE-2026-42163

Immediate Actions Required

Upgrade Mahara to version 25.04.5, 26.04.0, or later on all production and staging instances.
Audit configured LTI 1.1 consumer keys and LTI 1.3 Advantage client registrations, and remove entries that are no longer required.
Review recent LTI-initiated sessions for internal or administrative accounts and revoke any suspicious sessions.

Patch Information

Mahara has released fixed versions 25.04.5 and 26.04.0 that correct the LTI account resolution logic. Administrators should apply the upgrade following the standard Mahara upgrade procedure and confirm the version string after deployment. Refer to the Mahara Forum Discussion for release notes and upgrade guidance.

Workarounds

Disable the LTI 1.1 and LTI 1.3 Advantage authentication plugins until the patched version can be installed.
Restrict network access to Mahara LTI endpoints to the IP ranges of known, trusted LMS tool consumers.
Rotate all LTI 1.1 shared secrets and LTI 1.3 client credentials after upgrading to invalidate any previously exposed keys.

bash

# Verify installed Mahara version and disable LTI auth plugin as a temporary workaround
grep -R "RELEASE" /path/to/mahara/htdocs/lib/version.php
# In the Mahara admin UI: Administration > Extensions > Plugin administration
# Set 'auth/lti' to Disabled until the patched release is deployed