CVE-2025-67852: 
PHP vulnerability analysis and mitigation

CVE-2025-67852 is an open redirect vulnerability in Moodle's OAuth login flow that allows a remote attacker to redirect authenticated users to attacker-controlled pages. The flaw stems from insufficient validation of redirect parameters during the OAuth authentication process. Affected versions include Moodle < 4.1.22, >= 4.4.0-beta and < 4.4.12, >= 4.5.0-beta and < 4.5.8, >= 5.0.0-beta and < 5.0.4, and >= 5.1.0-beta and < 5.1.1. The vulnerability was reported on December 19, 2025, and published to the GitHub Advisory Database on February 3, 2026. It carries a CVSS v3.1 base score of 3.5 (Low) per GitHub Advisory, though an alternative scoring of 6.1 (Medium) has also been assigned (Github Advisory, Red Hat Bugzilla).

The vulnerability is classified as CWE-601 (URL Redirection to Untrusted Site / Open Redirect), arising from Moodle's OAuth login flow failing to adequately validate the redirect parameter supplied in authentication requests (Github Advisory). An attacker can craft a malicious OAuth login URL containing a redirect parameter pointing to an external, attacker-controlled site; after the user successfully authenticates, Moodle follows the unvalidated redirect and sends the user to the malicious destination. Exploitation requires user interaction (the victim must click a crafted link) and low privileges, and the attack vector is network-based. A patch commit is publicly referenced at moodle/moodle@fa1624c (Github Advisory).

Successful exploitation allows an attacker to redirect authenticated Moodle users to arbitrary external sites, enabling phishing attacks where users may be deceived into submitting credentials or sensitive information on fake pages. The vulnerability results in low confidentiality impact and no integrity or availability impact, as the attacker cannot directly access Moodle data but can harvest information through social engineering post-redirect. The scope is unchanged, meaning the impact is limited to the user's session context rather than the Moodle server itself (Github Advisory, Red Hat Bugzilla).

There is no public proof-of-concept exploit and no evidence of active in-the-wild exploitation at this time (Github Advisory). The EPSS score is approximately 0.015% (4th percentile), indicating a very low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. No threat actor attribution has been reported.

1. Reconnaissance: Identify publicly accessible Moodle instances running affected versions (< 4.1.22, < 4.4.12, < 4.5.8, < 5.0.4, or < 5.1.1) using search engines or web scanners.
2. Craft malicious URL: Construct a Moodle OAuth login URL that includes a redirect parameter pointing to an attacker-controlled site, e.g., https://moodle.example.com/auth/oauth2/login.php?wantsurl=https://attacker.example.com/phish.
3. Deliver to target: Send the crafted URL to a target user via phishing email, social media, or other communication channels, enticing them to click the link.
4. User authenticates: The victim clicks the link, is presented with the legitimate Moodle OAuth login page, and completes authentication normally.
5. Redirect occurs: After successful authentication, Moodle follows the unvalidated redirect parameter and sends the user's browser to the attacker-controlled page.
6. Harvest credentials or information: The attacker's page may mimic Moodle or another trusted service to collect credentials, session tokens, or other sensitive information from the now-authenticated user (Github Advisory, Red Hat Bugzilla).

• Network: Outbound HTTP redirects from the Moodle server to external, non-whitelisted domains immediately following OAuth authentication flows; unusual referrer headers in web server logs pointing to external sites.
• Logs: Moodle web server access logs showing OAuth login requests (e.g., /auth/oauth2/login.php) with wantsurl or similar redirect parameters containing external URLs; repeated login attempts with varying external redirect destinations from the same source IP.
• Application Logs: Moodle authentication logs recording successful logins followed immediately by redirects to external domains outside the Moodle installation's configured site URL.

Moodle has released patched versions addressing this vulnerability: 4.1.22, 4.4.12, 4.5.8, 5.0.4, and 5.1.1. Administrators should upgrade to the appropriate patched version as the primary remediation (Github Advisory). As interim mitigations, organizations can implement network-level controls to restrict redirect destinations to whitelisted domains, enforce OAuth state parameter and nonce validation, and monitor authentication logs for suspicious redirect attempts. Users should be educated to verify URLs after authentication, particularly when accessing Moodle via links received in email or messaging platforms.

The vulnerability was discussed in the Moodle community forums and tracked by Red Hat's Product Security team, which filed a Bugzilla report and assigned it low severity (Red Hat Bugzilla, Moodle Forum). No significant broader media coverage or notable researcher commentary beyond standard vulnerability database entries has been identified.