CVE-2025-53021: Moodle Session Fixation Vulnerability Allows Session Hijacking
Summary
CVE-2025-53021: Moodle Session Fixation allows unauthenticated users to hijack sessions via sesskey parameter. Affects moodle/moodle versions >= 3.0.0, < 4.0.0. Fixed in 4.0.0. How to fix ↓
Also tracked for
- moodle · Bitnami
The same CVE-2025-53021 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Moodle is an open-source learning platform designed to provide educators, administrators, and learners with a single robust, secure, and integrated system to create personalized learning environments. It supports various functionalities such as course management, user enrollment, and assessment tools. However, certain versions of Moodle are vulnerable to session fixation attacks, which can compromise user accounts.
Vulnerability Detail
A session fixation vulnerability exists in Moodle versions 3.x through 3.11.18, allowing unauthenticated attackers to hijack user sessions via the 'sesskey' parameter. This parameter can be obtained without authentication and reused within the OAuth2 login flow, linking the victim's session to the attacker's. Successful exploitation can lead to full account takeover, posing significant security risks to users. The vulnerability is classified under CWE-384.
How To Fix
Minimum fixed version
4.0.0
This is the first release that contains the fix.
composer require moodle/moodle:4.0.0Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, it is advisable to restrict access to the affected versions of Moodle and monitor user sessions closely until an update can be applied.
Conclusion
The session fixation vulnerability in Moodle versions 3.x through 3.11.18 poses a significant risk of session hijacking and account takeover. It is crucial for users to update to version 4.0.0 or later to mitigate this risk. Regular monitoring and vulnerability scanning can help maintain the security of your applications.
See every vulnerability recorded for moodle/moodle →
FAQ
Session fixation is a type of attack where an attacker sets a user's session ID to a known value, allowing them to hijack the session once the user logs in.
If you are using Moodle version 3.x through 3.11.18, your installation is vulnerable. You can check your version in the admin dashboard or by using the Vulert playground to scan your application.
Exploitation of this vulnerability can lead to full account takeover, allowing attackers to access sensitive user data and perform actions on behalf of the victim.
Yes, you can use Vulert, which monitors and alerts in real-time for open-source vulnerabilities in your software using the composer.lock file.
The CVSS score for this vulnerability is 4.2, indicating a moderate severity level.
Related vulnerabilities
Recent vulnerabilities recorded for moodle/moodle.
