CVE-2025-67852: Moodle: moodle: open redirect vulnerability in oauth login flow allows redirection to malicious sites.
A flaw was found in Moodle. An open redirect vulnerability in the OAuth login flow allows a remote attacker to redirect users to attacker-controlled pages after they have successfully authenticated. This occurs due to insufficient validation of redirect parameters, which could lead to phishing attacks or information disclosure.
Other sources
An open redirect vulnerability in the OAuth login flow could be abused to redirect users to attacker-controlled pages after authentication. This arises from insufficient validation of redirect parameters.
— Red Hat
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2025-67852?
The severity of CVE-2025-67852 is categorized as medium due to the potential for attackers to redirect users to malicious sites after authentication.
How do I fix CVE-2025-67852?
To fix CVE-2025-67852, update Moodle to versions 5.1.1, 5.0.4, 4.5.8, 4.4.12, or all versions prior to 4.1.22.
What software is affected by CVE-2025-67852?
CVE-2025-67852 affects multiple versions of Moodle, specifically versions prior to the patched versions listed.
What is an open redirect vulnerability in CVE-2025-67852?
An open redirect vulnerability in CVE-2025-67852 allows an attacker to induce a user to follow a maliciously crafted link after logging in.
Can CVE-2025-67852 be exploited remotely?
Yes, CVE-2025-67852 can be exploited remotely as it targets users during the OAuth login flow.