8.1

CVSS Score

3.1

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2025-67848

CVE-2025-67848: Moodle: moodle: authentication bypass via lti provider allows suspended users to gain unauthorized access.

A flaw was found in Moodle. This authentication bypass vulnerability allows suspended users to authenticate through the Learning Tools Interoperability (LTI) Provider. The issue arises from the LTI authentication handlers failing to enforce the user's suspension status, enabling unauthorized access to the system. This can lead to information disclosure or other unauthorized actions by users who should be restricted.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2025-67848

CVE-2025-67848:

8.1

CVSS Score

3.1

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
moodle/moodle	composer	< 4.1.22	4.1.22
moodle/moodle	composer	>= 4.4.0-beta, < 4.4.12	4.4.12
moodle/moodle	composer	>= 4.5.0-beta, < 4.5.8	4.5.8
moodle/moodle	composer	>= 5.0.0-beta, < 5.0.4	5.0.4
moodle/moodle	composer	>= 5.1.0-beta, < 5.1.1	5.1.1

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability allows suspended users to authenticate through the Learning Tools Interoperability (LTI) Provider in Moodle. The analysis of the provided patches reveals two key functions where the vulnerability existed and was subsequently fixed.

tool_provider::onLaunch in public/enrol/lti/classes/tool_provider.php: This function is part of the legacy LTI enrollment process. The patch 62f372e9d861d16df702d3c7726905fa2730e3d8 introduces a check for user suspension. The absence of this check meant that a suspended user could initiate an LTI launch and proceed with authentication, bypassing the suspension restriction.
auth_plugin_lti::complete_login in public/auth/lti/auth.php: This function is part of the LTI 1.3 authentication process. The patch c2705e2c18962fec4f21b9c34ed386be2a379663 adds a similar check for user suspension. Without this check, a suspended user could complete the LTI login flow, gaining unauthorized access to the system.

The root cause of the vulnerability is the failure to enforce user suspension status in the LTI authentication handlers. By identifying the exact locations where the suspension checks were added, we can pinpoint the vulnerable functions that would be present in a runtime profile during an exploitation attempt.

Vulnerable functions

tool_provider::onLaunch

public/enrol/lti/classes/tool_provider.php

The `onLaunch` function in `tool_provider` is responsible for handling LTI launches. The patch adds a check to see if a user is suspended (`$dbuser->suspended`). Before this patch, this check was missing, allowing a suspended user to authenticate successfully.

auth_plugin_lti::complete_login

public/auth/lti/auth.php

The `complete_login` function in `auth_plugin_lti` is responsible for completing the LTI login process. The patch adds a check to see if a user is suspended (`$user->suspended`). Before this patch, this check was missing, allowing a suspended user to complete the authentication process.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.