4.2

CVSS Score

3.1

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2025-53021

CVE-2025-53021: Moodle Session Fixation allows unauthenticated users to hijack sessions via sesskey parameter

A session fixation vulnerability in Moodle 3.x through 3.11.18 allows unauthenticated attackers to hijack user sessions via the sesskey parameter. The sesskey can be obtained without authentication and reused within the OAuth2 login flow, resulting in the victim's session being linked to the attacker's. Successful exploitation results in full account takeover. According to the Moodle Releases page, "Bug fixes for security issues in 3.11.x ended 11 December 2023." NOTE: This vulnerability only affects products that are no longer supported by the maintainer.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2025-53021

CVE-2025-53021:

4.2

CVSS Score

3.1

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
moodle/moodle	composer	>= 3.0.0, <= 3.11.18	4.0.0

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The analysis is based on the provided vulnerability description and a publicly available proof-of-concept. The vulnerability is a classic session fixation attack within Moodle's OAuth2 authentication mechanism. The root cause is the system's failure to create a new session for a user upon successful login, instead reusing the session identifier (sesskey) provided in the login URL.

The exploitation process, as detailed in the PoC, begins with the attacker directing the victim to a specially crafted URL pointing to auth/oauth2/login.php. This URL contains a sesskey obtained from an unauthenticated session initiated by the attacker. This script, auth/oauth2/login.php, is therefore the primary entry point for the vulnerability.

After the victim authenticates with the OAuth2 provider, the callback process in Moodle is initiated. During this phase, the core_auth\api::set_user_session function is called to associate the authenticated user with the current session. Because the session ID was not regenerated after authentication, this function effectively logs the victim into the session controlled by the attacker.

Identifying a precise patch is challenging because the vulnerability affected an end-of-life version (3.11.x) and was addressed in a new major version (4.0.0). Such upgrades often involve substantial code refactoring, meaning the fix is likely part of a larger rewrite of the authentication system rather than a simple, targeted patch. The identified functions are based on the clear evidence from the PoC and a logical analysis of the session fixation workflow in Moodle's architecture.

Vulnerable functions

Only Mi**o us*rs **n s** t*is s**tion

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.