CVE-2025-67853

Published: Feb 3, 2026Modified: Jun 17, 2026

7.5

Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Exploitability: 3.9 / Impact: 3.6

Source: patrick@puiterwijk.org (Secondary)

Description

A flaw was found in Moodle. A remote attacker could exploit a lack of proper rate limiting in the confirmation email service. This vulnerability allows attackers to more easily enumerate or guess user credentials, facilitating brute-force attacks against user accounts.

Affected (5)

Products: Moodle: Moodle

1 product

Configuration A

5 vulnerable

Vulnerable Software	Affected Versions
Moodle Moodle	Before 4.1.22
Moodle Moodle	From 4.4.0 to 4.4.11
Moodle Moodle	From 4.5.0 to 4.5.8
Moodle Moodle	From 5.0.0 to 5.0.4
Moodle Moodle	Version 5.1.0

Related CWEs

Improper Restriction of Excessive Authentication Attempts

The product does not implement sufficient measures to prevent multiple failed authentication attempts within a short time frame, making it more susceptible to brute force attacks.

References (2)

https://access.redhat.com/security/cve/CVE-2025-67853

Source: patrick@puiterwijk.org

Third Party Advisory

https://bugzilla.redhat.com/show_bug.cgi?id=2423847

Source: patrick@puiterwijk.org

Third Party Advisory

Timeline

No history available yet.