Improper Restriction of Excessive Authentication Attempts in Moodle - CVE-2025-62399
Published: March 26, 2026 / Updated: March 26, 2026
Vulnerability identifier: #VU124621
CSH Severity: High
CVSS v4: 9.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N]
CVE-ID: CVE-2025-62399
CWE-ID: CWE-307
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote attacker to gain unauthorized access to otherwise restricted functionality.
The vulnerability exists due to the affected application does not limit the number of password attempts when the mobile client and auth_webservice were enabled. A remote attacker can brute force password checks against known usernames.
Affected software
Moodle
Fedora
moodle
Fedora
moodle
How to mitigate CVE-2025-62399
Install updates from vendor's website.
Moodle - addressed in versions 4.1.21, 4.4.11, 4.5.7, 5.0.3
moodle - addressed in versions 4.4.11-1.fc41, 4.5.7-1.fc42, 5.0.3-1.fc43
moodle - addressed in versions 4.4.11-1.fc41, 4.5.7-1.fc42, 5.0.3-1.fc43