-
CVSS Score
-Basic Information
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AI| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| moodle/moodle | composer | >= 3.3, < 3.3.5 | 3.3.5 |
| moodle/moodle | composer | >= 3.4, < 3.4.2 | 3.4.2 |
Miggo AIRoot Cause AnalysisThe vulnerability description indicates suspended OAuth2 users retained access. In Moodle's architecture, authentication plugins handle user status checks. The OAuth2 authentication plugin's user_authenticated_hook is responsible for post-login user management. The commit reference MDL-60101 and advisory discussion confirm the fix involved adding suspended status checks in the OAuth2 authentication flow. This function would be the logical location where suspended status verification was missing in vulnerable versions, as it's the primary point where authentication plugins interact with user account status after initial confirmation.