CVE-2025-67848: Moodle: moodle: authentication bypass via lti provider allows suspended users to gain unauthorized access.
A flaw was found in Moodle. This authentication bypass vulnerability allows suspended users to authenticate through the Learning Tools Interoperability (LTI) Provider. The issue arises from the LTI authentication handlers failing to enforce the user's suspension status, enabling unauthorized access to the system. This can lead to information disclosure or other unauthorized actions by users who should be restricted.
Other sources
An authentication bypass issue in the LTI Provider allowed suspended users to authenticate. The flaw stemmed from missing enforcement of suspension state in LTI authentication handlers, permitting access that should have been blocked.
— Red Hat
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2025-67848?
CVE-2025-67848 is classified as a serious vulnerability due to its potential for unauthorized access to suspended user accounts.
How do I fix CVE-2025-67848?
To remediate CVE-2025-67848, upgrade your Moodle installation to version 5.1.1, 5.0.4, 4.5.8, 4.4.12, or 4.1.22.
Who is affected by CVE-2025-67848?
CVE-2025-67848 affects users of Moodle where suspended accounts can authenticate via the LTI Provider.
What is the impact of CVE-2025-67848?
The impact of CVE-2025-67848 allows suspended users unauthorized access, potentially compromising the security of the platform.
When was CVE-2025-67848 discovered?
CVE-2025-67848 was identified as a vulnerability in Moodle but the specific discovery date is not explicitly mentioned.