CVE-2025-62399

Overview

Moodle is an open source learning management system written in PHP. Schools, universities, and companies use it to run online courses. IOMAD is a multi-tenant distribution of Moodle that lets one installation serve several companies or organizations; it is built on Moodle core and shares the affected code. The Web services authentication plugin (auth_webservice) is meant for accounts that call Moodle's web services with a username and password instead of a token, through the simpleserver.php endpoint of a web service protocol.

A Brute Force vulnerability (CVE-2025-62399) has been identified in the auth_webservice plugin of Moodle and IOMAD, which allows an unauthenticated attacker to test passwords for any local account through the web service username and password endpoint, outside the protections of the login form. Only sites that enable web services and the Web services authentication plugin are affected. Moodle tracks this issue as MSA-25-0048 (MDL-86327).

Per OWASP: A brute force attack can manifest itself in many different ways, but primarily consists in an attacker configuring predetermined values, making requests to a server using those values, and then analyzing the response. For the sake of efficiency, an attacker may use a dictionary attack (with or without mutations) or a traditional brute-force attack (with given classes of characters e.g.: alphanumeric, special, case (in)sensitive).

This issue affects all versions of Moodle before 4.1.21, versions 4.2.0 through 4.4.10, versions 4.5.0 through 4.5.6, and versions 5.0.0 through 5.0.2, including End-of-Life release lines such as Moodle 4.3. IOMAD releases built on these Moodle versions contain the same code and are affected as well.

Details

Module Info

• Product: Moodle, IOMAD
• Affected packages: moodle/moodle (auth/webservice)
• Affected versions: <4.1.21, >=4.2.0 <4.4.11, >=4.5.0 <4.5.7, >=5.0.0 <5.0.3
• GitHub repository: https://github.com/moodle/moodle (Moodle), https://github.com/iomad/iomad (IOMAD)
• Published packages: https://packagist.org/packages/moodle/moodle
• Package manager: Composer
• Fixed in:
  • OSS Moodle 4.1.21, 4.4.11, 4.5.7, 5.0.3
  • NES for Moodle v4.3.13
  • NES for IOMAD v4.3.4

Vulnerability Info

This High-severity vulnerability is found in the moodle/moodle package in all versions before 4.1.21, 4.2.0 through 4.4.10, 4.5.0 through 4.5.6, and 5.0.0 through 5.0.2 of Moodle, and in IOMAD releases built on those versions. Moodle rates it Minor.

When a web service request uses username and password authentication, webservice_server::authenticate_user() in webservice/lib.php checks that the Web services authentication plugin is enabled and passes the credentials to auth_plugin_webservice::user_login_webservice(). That method looked the user up by username alone and checked the password:

function user_login_webservice($username, $password) {
    global $CFG, $DB;
    // special web service login
    if ($user = $DB->get_record('user', array('username'=>$username, 'mnethostid'=>$CFG->mnet_localhost_id))) {
        return validate_internal_user_password($user, $password);
    }
    return false;
}

The lookup did not limit the check to accounts that use the webservice authentication method, and it did not skip deleted or suspended accounts, so any account whose password hash Moodle stores, such as an ordinary manual account, could be checked through this endpoint. A wrong password only triggers a webservice_login_failed event and an error. The request never goes through authenticate_user_login(), which is where Moodle applies its account lockout, login token, and login reCAPTCHA checks.

An unauthenticated attacker who knows or can guess usernames can therefore send repeated password guesses to the endpoint without the account being locked. A correct guess gives the attacker the account's password, which also works on the normal login page. Moodle's advisory describes the exposure as sites with the mobile client and auth_webservice enabled. Sites that do not enable the Web services authentication plugin are not exposed.

The fix restricts the lookup to active accounts that use the webservice authentication method, so the endpoint can no longer check passwords for other accounts:

$user = $DB->get_record('user', [
    'username' => $username,
    'auth' => 'webservice',
    'deleted' => '0',
    'suspended' => '0',
    'mnethostid' => $CFG->mnet_localhost_id,
]);

if ($user) {
    return validate_internal_user_password($user, $password);
}
return false;

Mitigation

Moodle publishes security fixes only for its supported release lines. Earlier release lines, including Moodle 4.3 and the IOMAD releases built on it, are End-of-Life and will not receive any public updates to address this issue.

Until an upgrade is possible, sites that do not need username and password web service access can disable the Web services authentication plugin under Site administration > Plugins > Authentication > Manage authentication. Token-based web service access does not depend on this plugin.

Users of the affected components should apply one of the following mitigations:

• Upgrade to Moodle 4.1.21, 4.4.11, 4.5.7, 5.0.3, or later, or to an IOMAD release built on one of those versions.
• Leverage a commercial support partner like HeroDevs for post-EOL security support.

Credits

• Petr Skoda (finder)