CVE-2026-102586: Moodle Cross-Site Scripting Vulnerability via Password Reset Link
Summary
CVE-2026-102586: Moodle: xss via password reset link due to insufficient username escaping. Affects moodle across 4 version ranges.
< 4.5.13
>= 5.0.0, < 5.0.9
>= 5.1.0, < 5.1.6
>= 5.2.0, < 5.2.2
Fixed in 4 releases; the minimum fixed version depends on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Moodle is an open-source learning platform designed to provide educators, administrators, and learners with a single robust, secure, and integrated system to create personalized learning environments. It is widely used in educational institutions for course management and online learning. However, a recent vulnerability has been identified that affects its password reset functionality, potentially exposing users to cross-site scripting (XSS) attacks.
Vulnerability Detail
A flaw was discovered in Moodle's password reset page due to insufficient sanitization of username input. This vulnerability allows a remote attacker to craft a malicious password reset link that, when accessed by an unauthenticated user, can execute arbitrary scripts in the victim's browser. This could lead to unauthorized actions being performed on behalf of the user, data theft, or other malicious activities.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
< 4.5.134.5.13 -
>= 5.0.0, < 5.0.95.0.9 -
>= 5.1.0, < 5.1.65.1.6 -
>= 5.2.0, < 5.2.25.2.2
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
As a temporary workaround, users can disable the password reset functionality until the update is applied. This can be done by modifying the configuration settings in the Moodle admin panel to prevent unauthenticated users from accessing the password reset page.
Conclusion
The CVE-2026-102586 vulnerability in Moodle poses a significant risk due to its potential for cross-site scripting attacks. Users are strongly advised to update to the latest patched versions to mitigate this risk. Additionally, utilizing tools like Vulert can help monitor and alert for such vulnerabilities in real-time.
See every vulnerability recorded for moodle →
FAQ
CVE-2026-102586 is a vulnerability in Moodle that allows for cross-site scripting (XSS) attacks via insufficient sanitization of username input on the password reset page.
Any Moodle user who utilizes the password reset functionality is potentially affected, especially if they are using versions prior to the patched releases.
The vulnerability could allow attackers to execute arbitrary scripts in the victim's browser, leading to data theft, unauthorized actions, or other malicious activities.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without any signup.
If immediate updating is not possible, consider disabling the password reset functionality as a temporary workaround until you can apply the necessary updates.
Related vulnerabilities
Recent vulnerabilities recorded for moodle.
