CVE-2025-67852

Published: Feb 3, 2026Modified: Jun 17, 2026

6.1

Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Exploitability: 2.8 / Impact: 2.7

Source: NVD

Description

A flaw was found in Moodle. An open redirect vulnerability in the OAuth login flow allows a remote attacker to redirect users to attacker-controlled pages after they have successfully authenticated. This occurs due to insufficient validation of redirect parameters, which could lead to phishing attacks or information disclosure.

Affected (5)

Products: Moodle: Moodle

1 product

Configuration A

5 vulnerable

Vulnerable Software	Affected Versions
Moodle Moodle	Before 4.1.22
Moodle Moodle	From 4.4.0 to 4.4.11
Moodle Moodle	From 4.5.0 to 4.5.8
Moodle Moodle	From 5.0.0 to 5.0.4
Moodle Moodle	Version 5.1.0

Related CWEs

URL Redirection to Untrusted Site ('Open Redirect')

A web application accepts a user-controlled input that specifies a link to an external site, and uses that link in a Redirect. This simplifies phishing attacks.

References (2)

https://access.redhat.com/security/cve/CVE-2025-67852

Source: patrick@puiterwijk.org

Third Party Advisory

https://bugzilla.redhat.com/show_bug.cgi?id=2423844

Source: patrick@puiterwijk.org

Issue TrackingThird Party Advisory

Timeline

No history available yet.