CVE-2025-62398
Unknown Unknown - Not Provided
BaseFortify

Publication date: 2025-10-23

Last updated on: 2025-11-14

Assigner: Fedora Project

Description
A serious authentication flaw allowed attackers with valid credentials to bypass multi-factor authentication under certain conditions, potentially compromising user accounts.
CVSS Scores
EPSS Scores
Probability:
Percentile:
Meta Information
Published
2025-10-23
Last Modified
2025-11-14
Generated
2026-06-16
AI Q&A
2025-10-23
EPSS Evaluated
2026-06-15
NVD
CVE-2025-62398
Affected Vendors & Products
Showing 3 associated CPEs
Vendor Product Version / Range
moodle moodle From 4.4.0 (inc) to 4.4.11 (exc)
moodle moodle From 4.5.0 (inc) to 4.5.7 (exc)
moodle moodle From 5.0.0 (inc) to 5.0.3 (exc)
Helpful Resources
Exploitability
CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-NVD-CWE-noinfo
CWE-287 When an actor claims to have a given identity, the product does not prove or insufficiently proves that the claim is correct.
Attack-Flow Graph
AI Quick Actions
Instant insights powered by AI
Executive Summary

CVE-2025-62398 is a high-severity vulnerability in Moodle that allows attackers with valid credentials to bypass multi-factor authentication (MFA) during login. This happens because certain login endpoints do not properly enforce MFA validation, enabling users who provide valid usernames and passwords to access accounts without completing the required second-factor authentication. [1]

Impact Analysis

This vulnerability can lead to unauthorized access to user accounts even if MFA is enabled, potentially compromising sensitive information and user data. Attackers who have valid credentials can bypass the second authentication factor, increasing the risk of account takeover and data breaches. [1]

Detection Guidance

Detection involves verifying if your Moodle installation is running a vulnerable version (5.0 to 5.0.2, 4.5 to 4.5.6, or 4.4 to 4.4.10). You can check the Moodle version by running the command: `grep '$release' /path/to/moodle/version.php`. Additionally, monitoring login attempts that bypass MFA could be done by analyzing web server logs for successful logins without second-factor authentication. However, no specific detection commands are provided. [1]

Mitigation Strategies

Immediately upgrade Moodle to a fixed version: 5.0.3, 4.5.7, or 4.4.11, depending on your current version. Until the upgrade is applied, consider restricting access to login endpoints or enforcing additional access controls to prevent MFA bypass. Also, monitor user accounts for suspicious activity. [1]

Chat Assistant
Ask questions about this CVE
Hi! I’m here to help you understand CVE-2025-62398. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70
EPSS Chart