CVE-2025-62399: Moodle: password brute force risk when mobile/web services enabled
Authentication endpoints for the mobile client and authwebservice allowed unlimited or insufficiently throttled password attempts. This could enable attackers to systematically guess passwords for known usernames.
Versions affected: 5.0 to 5.0.2, 4.5 to 4.5.6, 4.4 to 4.4.10, 4.1 to 4.1.20 and earlier unsupported versions Versions fixed: 5.0.3, 4.5.7, 4.4.11 and 4.1.21
Other sources
Moodle's mobile and web service authentication endpoints did not sufficiently restrict repeated password attempts, making them susceptible to brute-force attacks.
— GitHub
Moodle’s mobile and web service authentication endpoints did not sufficiently restrict repeated password attempts, making them susceptible to brute-force attacks.
— NVD
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2025-62399?
CVE-2025-62399 has a moderate severity level due to its potential for enabling brute-force attacks on user accounts.
How do I fix CVE-2025-62399?
To mitigate CVE-2025-62399, implement account lockout mechanisms or limit the number of allowable password attempts for Moodle's authentication endpoints.
Which versions of Moodle are affected by CVE-2025-62399?
CVE-2025-62399 affects all versions of Moodle's mobile and web service authentication endpoints that do not have improvements to restrict password attempts.
What impact does CVE-2025-62399 have on user accounts?
CVE-2025-62399 increases the risk of unauthorized access to user accounts through successful brute-force attacks.
Is there a known exploit for CVE-2025-62399?
As of now, there are no publicly disclosed exploits specifically targeting CVE-2025-62399, but the vulnerability itself presents a significant risk.