CVE-2025-67852

Overview

Moodle is an open source learning management system written in PHP. Schools, universities, and companies use it to run online courses. IOMAD is a multi-tenant distribution of Moodle that lets one installation serve several companies or organizations; it is built on Moodle core and shares the affected code. The OAuth 2 authentication plugin (auth_oauth2) lets users log in with an external identity provider such as Google or Microsoft. The login button sends the user to auth/oauth2/login.php with a wantsurl parameter that says where to go after login.

An Open Redirect vulnerability (CVE-2025-67852) has been identified in the OAuth 2 login flow of Moodle and IOMAD, which allows an attacker to craft a login link that sends the user to an external site of the attacker's choosing right after they log in successfully. Moodle tracks this issue as MSA-25-0056 (MDL-80317).

Per MITRE CWE-601: The web application accepts a user-controlled input that specifies a link to an external site, and uses that link in a redirect.

This issue affects all versions of Moodle before 4.1.22, versions 4.2.0 through 4.4.11, versions 4.5.0 through 4.5.7, versions 5.0.0 through 5.0.3, and version 5.1.0, including End-of-Life release lines such as Moodle 4.3. IOMAD releases built on these Moodle versions contain the same code and are affected as well.

Details

Module Info

• Product: Moodle, IOMAD
• Affected packages: moodle/moodle (auth/oauth2)
• Affected versions: <4.1.22, >=4.2.0 <4.4.12, >=4.5.0 <4.5.8, >=5.0.0 <5.0.4, >=5.1.0 <5.1.1
• GitHub repository: https://github.com/moodle/moodle (Moodle), https://github.com/iomad/iomad (IOMAD)
• Published packages: https://packagist.org/packages/moodle/moodle
• Package manager: Composer
• Fixed in:
  • OSS Moodle 4.1.22, 4.4.12, 4.5.8, 5.0.4, 5.1.1
  • NES for Moodle v4.3.13
  • NES for IOMAD v4.3.4

Vulnerability Info

This Low-severity vulnerability is found in the moodle/moodle package in all versions before 4.1.22, 4.2.0 through 4.4.11, 4.5.0 through 4.5.7, 5.0.0 through 5.0.3, and 5.1.0 of Moodle, and in IOMAD releases built on those versions. Moodle rates it Minor.

auth/oauth2/login.php read the wantsurl parameter with PARAM_URL, which accepts any well-formed URL, including one on another domain:

$issuerid = required_param('id', PARAM_INT);
$wantsurl = new moodle_url(optional_param('wantsurl', '', PARAM_URL));

The value is carried through the round trip to the identity provider in the return URL and then passed to auth_oauth2\auth::complete_login(). Once the user has been logged in, that method ends with redirect($redirecturl), sending the browser to whatever address wantsurl held.

An attacker can build a login link whose wantsurl points to a site they control, such as a copy of the Moodle login page. The victim sees the real Moodle site and the real identity provider, logs in, and is then moved to the attacker's page, where they may be asked for their password again or shown other misleading content. The request also has to carry the sesskey of the victim's current session, which login.php checks with require_sesskey(), and that limits how easily such a link can be delivered. Sites that do not have the OAuth 2 authentication plugin enabled are not exposed.

The fix reads wantsurl with PARAM_LOCALURL, which returns an empty string for any URL outside the Moodle site, so the redirect after login can only go to a local page:

$issuerid = required_param('id', PARAM_INT);
$wantsurl = optional_param('wantsurl', '', PARAM_LOCALURL);

Mitigation

Moodle publishes security fixes only for its supported release lines. Earlier release lines, including Moodle 4.3 and the IOMAD releases built on it, are End-of-Life and will not receive any public updates to address this issue.

Users of the affected components should apply one of the following mitigations:

• Upgrade to Moodle 4.1.22, 4.4.12, 4.5.8, 5.0.4, 5.1.1, or later, or to an IOMAD release built on one of those versions.
• Leverage a commercial support partner like HeroDevs for post-EOL security support.

Credits

• Paolo Lazzaroni (finder)