CVE-2025-3634: Moodle: moodle allows course self-enrolment before completing mfa
A security vulnerability was discovered in Moodle that allows students to enroll themselves in courses without completing all the necessary safety checks. Specifically, users can sign up for courses prematurely, even if they haven't finished two-step verification processes.
Other sources
On sites with Multi-Factor Authentication enabled, it was possible to use course self enrollment after passing only the first login factor (such as passing a username/password check). The user should also have to pass a second login factor before gaining access to self enrollment.
Versions affected: 4.5 to 4.5.3, 4.4 to 4.4.7 and 4.3 to 4.3.11 Versions fixed: 4.5.4, 4.4.8 and 4.3.12
— Red Hat
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2025-3634?
CVE-2025-3634 is categorized as a high-severity vulnerability due to its potential to allow unauthorized course enrollments.
How do I fix CVE-2025-3634?
To remediate CVE-2025-3634, upgrade to Moodle version 4.5.4, 4.4.8, or 4.3.12 depending on your current version.
Which versions of Moodle are affected by CVE-2025-3634?
CVE-2025-3634 affects Moodle versions 4.5.0 to 4.5.3, 4.4.0 to 4.4.7, and 4.3.0 to 4.3.11.
What can happen if CVE-2025-3634 is exploited?
If exploited, CVE-2025-3634 allows students to enroll in courses without completing required verification processes, potentially compromising course integrity.
Is there a patch available for CVE-2025-3634?
Yes, a patch is available in the form of updated versions: 4.5.4, 4.4.8, and 4.3.12 for Moodle.