3.5

CVSS Score

3.1

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2025-67852

CVE-2025-67852: Moodle: moodle: open redirect vulnerability in oauth login flow allows redirection to malicious sites.

A flaw was found in Moodle. An open redirect vulnerability in the OAuth login flow allows a remote attacker to redirect users to attacker-controlled pages after they have successfully authenticated. This occurs due to insufficient validation of redirect parameters, which could lead to phishing attacks or information disclosure.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2025-67852

CVE-2025-67852:

3.5

CVSS Score

3.1

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
moodle/moodle	composer	< 4.1.22	4.1.22
moodle/moodle	composer	>= 4.4.0-beta, < 4.4.12	4.4.12
moodle/moodle	composer	>= 4.5.0-beta, < 4.5.8	4.5.8
moodle/moodle	composer	>= 5.0.0-beta, < 5.0.4	5.0.4
moodle/moodle	composer	>= 5.1.0-beta, < 5.1.1	5.1.1

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability is an open redirect in Moodle's OAuth2 login flow. The provided commit fa1624c8c9e3efa917f0e9d2666bb59d8be2a975 directly addresses this issue. The patch modifies the public/auth/oauth2/login.php file, changing how the wantsurl parameter is handled. The vulnerable code used optional_param('wantsurl', '', PARAM_URL), which permitted redirection to any URL provided in the wantsurl parameter. The fix replaces PARAM_URL with PARAM_LOCALURL, ensuring that the redirection target is a local URL within the Moodle instance. This prevents attackers from redirecting users to malicious external websites. The vulnerable entry point is the login.php script itself, which would be visible in a runtime profile during the exploitation of this vulnerability.

Vulnerable functions

public/auth/oauth2/login.php

public/auth/oauth2/login.php

The vulnerability exists in the \'public/auth/oauth2/login.php\' script. The \'wantsurl\' parameter was validated with \'PARAM_URL\', which allowed any URL, creating an open redirect. The patch changes the validation to \'PARAM_LOCALURL\', which restricts the redirect to local URLs only, thus mitigating the vulnerability.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.