GHSA-j5jv-w5cw-j9ff
Moodle authentication bypass vulnerability
At a glance
- Published
- Updated
- CVE
- CVE-2025-67848
- Aliases
- BIT-moodle-2025-67848
- CVSS_V3
- CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
Description
A flaw was found in Moodle. This authentication bypass vulnerability allows suspended users to authenticate through the Learning Tools Interoperability (LTI) Provider. The issue arises from the LTI authentication handlers failing to enforce the user's suspension status, enabling unauthorized access to the system. This can lead to information disclosure or other unauthorized actions by users who should be restricted.
Affected packages
| Package | Versions |
|---|---|
| Packagist · moodle/moodle | introduced 0, fixed 4.1.22 |
| Packagist · moodle/moodle | introduced 4.4.0-beta, fixed 4.4.12 |
| Packagist · moodle/moodle | introduced 4.5.0-beta, fixed 4.5.8 |
| Packagist · moodle/moodle | introduced 5.0.0-beta, fixed 5.0.4 |
| Packagist · moodle/moodle | introduced 5.1.0-beta, fixed 5.1.1 |
References
- https://nvd.nist.gov/vuln/detail/CVE-2025-67848 ADVISORY
- https://github.com/moodle/moodle/commit/62f372e9d861d16df702d3c7726905fa2730e3d8 WEB
- https://github.com/moodle/moodle/commit/c2705e2c18962fec4f21b9c34ed386be2a379663 WEB
- https://access.redhat.com/security/cve/CVE-2025-67848 WEB
- https://bugzilla.redhat.com/show_bug.cgi?id=2423831 WEB
- https://github.com/moodle/moodle PACKAGE
- https://moodle.org/mod/forum/discuss.php?d=471298 WEB
Sources
| Source | Licence |
|---|---|
| OSV.dev | CC-BY 4.0 — GitHub Advisory Database |