CVE-2025-67853: 
PHP vulnerability analysis and mitigation

CVE-2025-67853 is a brute-force facilitation vulnerability in Moodle caused by missing rate limiting in the confirmation email service. A remote, unauthenticated attacker can exploit this flaw to enumerate or guess user credentials with reduced resistance, enabling brute-force attacks against user accounts. The vulnerability was reported on December 19, 2025, and publicly disclosed on February 3, 2026. Affected versions include Moodle < 4.1.22, 4.4.0–4.4.11, 4.5.0–4.5.7, 5.0.0–5.0.3, and 5.1.0. It carries a CVSS v3.1 base score of 7.5 (High) (Github Advisory, Red Hat Bugzilla).

The root cause is classified as CWE-307 (Improper Restriction of Excessive Authentication Attempts): Moodle's confirmation email service endpoint does not implement sufficient controls to throttle or block repeated requests from the same source. This allows an unauthenticated remote attacker to send unlimited requests to the endpoint over the network with low complexity and no user interaction required, effectively using it as an oracle to enumerate valid usernames or systematically guess credentials. No authentication or special privileges are required to trigger the vulnerable behavior (Github Advisory, Red Hat Bugzilla).

Successful exploitation primarily impacts confidentiality (CVSS C:High), as attackers can enumerate valid user accounts and compromise credentials, potentially gaining unauthorized access to sensitive data stored within Moodle instances such as course materials, personal information, and communications. There is no direct integrity or availability impact from the vulnerability itself, but account compromise could enable further lateral movement within the platform or connected systems. Educational institutions and organizations relying on Moodle for learning management are particularly at risk given the platform's broad user base (Github Advisory).

As of the disclosure date, there is no public proof-of-concept exploit and no evidence of active in-the-wild exploitation (Github Advisory). The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. The EPSS score is approximately 0.035% (11th percentile), indicating a low near-term exploitation probability. The attack requires no authentication, no user interaction, and low complexity, making it straightforward to exploit if targeted, but the lack of weaponized tooling reduces immediate risk.

1. Reconnaissance: Identify internet-facing Moodle instances running vulnerable versions (< 4.1.22, 4.4.0–4.4.11, 4.5.0–4.5.7, 5.0.0–5.0.3, or 5.1.0) using search engines, Shodan, or Censys by fingerprinting Moodle login pages.
2. Target the confirmation email endpoint: Send repeated HTTP requests to the Moodle confirmation email service endpoint without any authentication, exploiting the absence of rate limiting.
3. Enumerate valid usernames: Observe differences in server responses (e.g., response time, error messages, or email delivery behavior) to determine whether a submitted username or email address corresponds to a valid account.
4. Conduct brute-force or credential stuffing: Using the enumerated valid accounts, systematically attempt password guessing, dictionary attacks, or credential stuffing against the Moodle login endpoint to gain unauthorized access.
5. Achieve account compromise: Successfully authenticated sessions allow access to course data, personal information, and administrative functions depending on the compromised account's privilege level (Github Advisory, Red Hat Bugzilla).

• Network: High volume of repeated HTTP requests to the Moodle confirmation email service endpoint from a single IP or small range of IPs; unusual spikes in POST/GET traffic to authentication-related Moodle URLs.
• Logs: Moodle access logs showing a large number of requests to the confirmation email endpoint in a short time window; repeated failed login attempts for multiple usernames from the same source IP.
• Application: Unusual patterns of account confirmation requests not correlated with legitimate user registrations; multiple requests for non-existent or rarely-used accounts.

Moodle has released patched versions addressing this vulnerability: 4.1.22, 4.4.12, 4.5.8, 5.0.4, and 5.1.1 (Github Advisory). Administrators should upgrade to the appropriate patched version immediately. As interim mitigations, implement network-level or web application firewall (WAF) rate limiting on the confirmation email service endpoint, enforce account lockout policies after repeated failed authentication attempts, and monitor authentication logs for brute-force activity patterns.

The vulnerability was noted in the Secret CISO newsletter and referenced on Mastodon by security community accounts shortly after disclosure. Tenable published a Nessus plugin (ID 297886) to detect the vulnerability. Red Hat tracked the issue via Bugzilla and issued a security advisory. No major vendor statements or significant researcher commentary beyond standard disclosure channels have been identified (Github Advisory).