CVE-2025-3634: Moodle Self Enrollment Bypass with MFA Enabled
Summary
CVE-2025-3634: Moodle self enrollment available before completing second factor with MFA enabled. Affects moodle/moodle across 3 version ranges.
>= 4.3.0-beta, < 4.3.12
>= 4.4.0-beta, < 4.4.8
>= 4.5.0-beta, < 4.5.4
Fixed in 4.3.12, 4.4.8 or 4.5.4, depending on the release line you run. How to fix ↓
Also tracked for
- moodle · Bitnami
The same CVE-2025-3634 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Moodle is an open-source learning platform designed to provide educators, administrators, and learners with a single robust, secure, and integrated system to create personalized learning environments. It offers features such as course management, user enrollment, and assessment tools. However, a vulnerability has been identified that allows students to enroll in courses without completing the necessary multi-factor authentication (MFA) checks, potentially compromising the security of course access.
Vulnerability Detail
A security vulnerability in Moodle allows students to enroll themselves in courses without completing the required two-step verification process when MFA is enabled. This issue arises from improper handling of enrollment requests, which can lead to unauthorized access to course materials and sensitive information. The vulnerability is classified under CWE-287, indicating a failure in authentication mechanisms. If exploited, this could lead to unauthorized course access, impacting both students and educators.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
>= 4.3.0-beta, < 4.3.124.3.12composer require moodle/moodle:4.3.12 -
>= 4.4.0-beta, < 4.4.84.4.8composer require moodle/moodle:4.4.8 -
>= 4.5.0-beta, < 4.5.44.5.4composer require moodle/moodle:4.5.4
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
As a temporary workaround, administrators can disable self-enrollment for courses until the package is updated. This can be done by navigating to the course settings and unchecking the self-enrollment option.
Conclusion
In summary, the identified vulnerability in Moodle allows unauthorized course enrollment due to improper MFA handling. It is crucial for administrators to update their Moodle installations to the latest patched versions to ensure security and prevent unauthorized access. Utilizing tools like Vulert can help monitor and alert for such vulnerabilities in real-time.
See every vulnerability recorded for moodle/moodle →
FAQ
The vulnerability allows students to enroll in courses without completing the MFA process, which can lead to unauthorized access.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without any signup.
The vulnerability affects Moodle versions starting from 4.3.0-beta up to the fixed versions of 4.3.12, 4.4.8, and 4.5.4.
If immediate updates are not possible, consider disabling self-enrollment as a temporary measure to mitigate risks.
The CVSS score of this vulnerability is 4.3, indicating a moderate level of severity.
Related vulnerabilities
Recent vulnerabilities recorded for moodle/moodle.
