Introduction
Attackers could use automated password guessing against Moodle's mobile and web service authentication endpoints, which could have exposed sensitive educational data across hundreds of millions of users. The vulnerability, tracked as CVE-2025-62399, affected a wide range of actively supported Moodle versions and required urgent attention from administrators in educational and institutional environments.
About Moodle: Moodle is the world's most widely used open-source learning management system, with over 350 million users in 242 countries. Schools, universities, and organizations around the world run their digital learning on it, so any security flaw in its authentication has a large impact on the education sector.
Technical Information
CVE-2025-62399 is classified under CWE-307 (Improper Restriction of Excessive Authentication Attempts). Moodle's mobile and web service authentication endpoints did not sufficiently restrict repeated password attempts. The standard web login form enforces account lockout and rate limiting, both configurable in the admin interface, but the mobile and REST API authentication code paths did not apply those protections consistently.
Attackers could point automated scripts at endpoints such as /login/token.php and submit a high volume of password guesses for known or enumerated usernames. These endpoints did not trigger the lockout mechanisms that protect the main login page, so a brute-force attack could continue unimpeded until it found a valid credential. The gap left a significant attack surface for credential stuffing and password guessing against Moodle deployments with mobile or web services enabled.
No public code snippets or detailed vulnerable code locations have been released. The fix enforces rate limiting and lockout controls consistently across all authentication entry points, including the ones that mobile apps and web service integrations use.
Affected Systems and Versions
The following Moodle versions were affected:
- Moodle 5.0.0 through 5.0.2
- Moodle 4.5.0 through 4.5.6
- Moodle 4.4.0 through 4.4.10
- Moodle 4.1.0 through 4.1.20
- All earlier unsupported versions
The vulnerability was present when mobile or web services were enabled. The issue was fixed in:
- Moodle 5.0.3
- Moodle 4.5.7
- Moodle 4.4.11
- Moodle 4.1.21
Vendor Security History
Moodle has a mature security process and regularly publishes coordinated advisories. Previous notable vulnerabilities include:
- Authentication bypass in quiz functionality
- Remote code execution via formula validation flaws
- Information disclosure in user profile handling
Moodle typically patches critical issues promptly and releases the fixes across all supported branches. The project has a dedicated security team and public advisory channels.
