CVE-2025-62399

Published: Oct 23, 2025Modified: Jun 17, 2026

7.5

Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Exploitability: 3.9 / Impact: 3.6

Source: patrick@puiterwijk.org (Secondary)

Description

Moodle’s mobile and web service authentication endpoints did not sufficiently restrict repeated password attempts, making them susceptible to brute-force attacks.

Affected (4)

Products: Moodle: Moodle

Moodle

1 product

Moodle

Configuration A

4 vulnerable

Vulnerable Software	Affected Versions
Moodle Moodle	From 4.1.0 to 4.1.21
Moodle Moodle	From 4.4.0 to 4.4.11
Moodle Moodle	From 4.5.0 to 4.5.7
Moodle Moodle	From 5.0.0 to 5.0.3

Related CWEs

CWE-307

Improper Restriction of Excessive Authentication Attempts

The product does not implement sufficient measures to prevent multiple failed authentication attempts within a short time frame, making it more susceptible to brute force attacks.

References (2)

https://access.redhat.com/security/cve/CVE-2025-62399

Source: patrick@puiterwijk.org

Third Party Advisory

https://bugzilla.redhat.com/show_bug.cgi?id=2404432

Source: patrick@puiterwijk.org

Issue TrackingThird Party Advisory

Timeline

No history available yet.