Improper Restriction of Excessive Authentication Attempts in Moodle - CVE-2025-67853

 

Improper Restriction of Excessive Authentication Attempts in Moodle - CVE-2025-67853

Published: March 26, 2026


Vulnerability identifier: #VU124630
CSH Severity: Medium
CVSS v4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]
CVE-ID: CVE-2025-67853
CWE-ID: CWE-307
Exploitation vector: Remote access
Exploit availability: No public exploit available

Vulnerability details

The vulnerability allows a remote attacker to gain unauthorized access to otherwise restricted functionality.

The vulnerability exists due to the affected application does not limit the number of password attempts within confirmation email web service. A remote attacker can brute force password checks on the target system.


Affected software

Moodle

How to mitigate CVE-2025-67853

Install updates from vendor's website.

Moodle - addressed in versions 4.1.22, 4.4.12, 4.5.8, 5.0.4, 5.1.1

External References

Related Security Bulletins