CVE-2026-102586: Moodle: xss via password reset link due to insufficient username escaping
A flaw was found in Moodle. Insufficient escaping of the username on the password reset page allowed a minor cross-site scripting (XSS) risk if an unauthenticated user was tricked into opening a crafted password reset link. The reporter states this did not affect authenticated user sessions; that disclaimer is reflected in the impact assessment here.
Other sources
A flaw was found in Moodle. Insufficient sanitization of username input on the password reset page allows a remote attacker to conduct a cross-site scripting (XSS) attack. By convincing an unauthenticated user to access a specially crafted password reset link, an attacker could execute arbitrary script in the victim's browser.
— MITRE
Affected Software
Event History
Frequently Asked Questions
Who is exposed to this issue?
The issue affects unauthenticated users who can be persuaded to open a specially crafted password reset link. The available information states that authenticated user sessions are not affected.
What does an attacker need to exploit it?
An attacker can operate remotely without privileges, but must convince an unauthenticated victim to access a crafted password reset link. User interaction is therefore required.
What is the likely impact of successful exploitation?
Successful exploitation can execute arbitrary script in the unauthenticated victim's browser through the password reset page. The assessed impact is limited to confidentiality, with no integrity or availability impact indicated.