Signal is active with 2 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
A flaw was found in Moodle. This authentication bypass vulnerability allows suspended users to authenticate through the Learning Tools Interoperability (LTI) Provider. The issue arises from the LTI authentication handlers failing to enforce the user's suspension status, enabling unauthorized access to the system. This can lead to information disclosure or other unauthorized actions by users who should be restricted.
Priority
LOW
Exploitation
NONE
PoC
NONE
Patch
NONE
Momentum
NONE
If you run products in this scope, you should treat this CVE as relevant to your environment.
1 version affected across 1 product
CVE-2025-67848 A flaw was found in Moodle. This authentication bypass vulnerability allows suspended users to authenticate through the Learning Tools Interoperability (LTI) Provider… https://www.cve.org/CVERecord?id=CVE-2025-67848
Post summary
A vulnerability in Moodle (CVE‑2025‑67848) allows suspended users to authenticate via the LTI Provider, providing an authentication bypass.
🟠 CVE-2025-67848 - High A flaw was found in Moodle. This authentication bypass vulnerability allows suspended users to authenticate through the Learning Tools Interoperability (LTI) Provider. The issue arises from t... https://www.thehackerwire.com/vulnerability/CVE-2025-67848/ https://t.co/nllzvsxyhP
Post summary
The post discloses a Moodle authentication bypass that lets suspended users authenticate via the LTI Provider, but provides no PoC, exploit code, patch details, or evidence of active exploitation.
2 of 2 entries
| Part | Vendor | Product | Version | Target SW | Target HW |
|---|---|---|---|---|---|
| App | moodle | moodle | - | - | - |
| App | moodle | moodle | 5.1.0 | - | - |