CVE-2025-53021
Moodle Session Fixation allows unauthenticated users to hijack sessions via sesskey parameter
A session fixation vulnerability in Moodle 3.x through 3.11.18 allows unauthenticated attackers to hijack user sessions via the sesskey parameter. The sesskey can be obtained without authentication and reused within the OAuth2 login flow, resulting in the victim's session being linked to the attacker's. Successful exploitation results in full account takeover. According to the Moodle Releases page, "Bug fixes for security issues in 3.11.x ended 11 December 2023." NOTE: This vulnerability only affects products that are no longer supported by the maintainer.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- High
- Privileges needed
- None
- User interaction
- Required
What an attacker can affect
- Confidentiality
- Low
- Integrity
- Low
- Availability
- None
Exploit likelihood
What each source reports
CVE List Score used
A session fixation vulnerability in Moodle 3.x through 3.11.18 allows unauthenticated attackers to hijack user sessions via the sesskey parameter. The sesskey can be obtained without authentication and reused within the OAuth2 login flow, resulting in the victim's session being linked to the attacker's. Successful exploitation results in full account takeover. According to the Moodle Releases page, "Bug fixes for security issues in 3.11.x ended 11 December 2023." NOTE: This vulnerability only affects products that are no longer supported by the maintainer.
- Record
CVE-2025-53021- CVSS 3.1
- 4.2 Medium
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:N - Weakness
- CWE-384
- Updated
- 2026-11-02
EUVDEUVD-2025-19060
A session fixation vulnerability in Moodle 3.x through 3.11.18 allows unauthenticated attackers to hijack user sessions via the sesskey parameter. The sesskey can be obtained without authentication and reused within the OAuth2 login flow, resulting in the victim's session being linked to the attacker's. Successful exploitation results in full account takeover. According to the Moodle Releases page, "Bug fixes for security issues in 3.11.x ended 11 December 2023." NOTE: This vulnerability only affects products that are no longer supported by the maintainer.
- Record
EUVD-2025-19060- CVSS 3.1
- 4.2 Medium
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:N - Updated
- 2026-11-02
GitHub AdvisoriesGHSA-cgvv-3455-824j
Moodle Session Fixation allows unauthenticated users to hijack sessions via sesskey parameter
A session fixation vulnerability in Moodle 3.x through 3.11.18 allows unauthenticated attackers to hijack user sessions via the sesskey parameter. The sesskey can be obtained without authentication and reused within the OAuth2 login flow, resulting in the victim's session being linked to the attacker's. Successful exploitation results in full account takeover. According to the Moodle Releases page, "Bug fixes for security issues in 3.11.x ended 11 December 2023." NOTE: This vulnerability only affects products that are no longer supported by the maintainer.
- Record
GHSA-cgvv-3455-824j- CVSS 3.1
- 4.2 Medium
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:N - Weakness
- CWE-384
- Updated
- 2026-11-02
NVD
A session fixation vulnerability in Moodle 3.x through 3.11.18 allows unauthenticated attackers to hijack user sessions via the sesskey parameter. The sesskey can be obtained without authentication and reused within the OAuth2 login flow, resulting in the victim's session being linked to the attacker's. Successful exploitation results in full account takeover. According to the Moodle Releases page, "Bug fixes for security issues in 3.11.x ended 11 December 2023." NOTE: This vulnerability only affects products that are no longer supported by the maintainer.
- Record
CVE-2025-53021- CVSS 3.1
- 4.2 Medium
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:N - Weakness
- CWE-384
- Updated
- 2026-11-02
OSV
A session fixation vulnerability in Moodle 3.x through 3.11.18 allows unauthenticated attackers to hijack user sessions via the sesskey parameter. The sesskey can be obtained without authentication and reused within the OAuth2 login flow, resulting in the victim's session being linked to the attacker's. Successful exploitation results in full account takeover. According to the Moodle Releases page, "Bug fixes for security issues in 3.11.x ended 11 December 2023." NOTE: This vulnerability only affects products that are no longer supported by the maintainer.
- Record
CVE-2025-53021- CVSS 3.1
- 4.2 Medium
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:N - Weakness
- CWE-384
- Updated
- 2026-11-02
OSVGHSA-cgvv-3455-824j
Moodle Session Fixation allows unauthenticated users to hijack sessions via sesskey parameter
A session fixation vulnerability in Moodle 3.x through 3.11.18 allows unauthenticated attackers to hijack user sessions via the sesskey parameter. The sesskey can be obtained without authentication and reused within the OAuth2 login flow, resulting in the victim's session being linked to the attacker's. Successful exploitation results in full account takeover. According to the Moodle Releases page, "Bug fixes for security issues in 3.11.x ended 11 December 2023." NOTE: This vulnerability only affects products that are no longer supported by the maintainer.
- Record
GHSA-cgvv-3455-824j- CVSS 3.1
- 4.2 Medium
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:N - Weakness
- CWE-384
- Updated
- 2026-11-02
OSVUBUNTU-CVE-2025-53021
A session fixation vulnerability in Moodle 3.x through 3.11.18 allows unauthenticated attackers to hijack user sessions via the sesskey parameter. The sesskey can be obtained without authentication and reused within the OAuth2 login flow, resulting in the victim's session being linked to the attacker's. Successful exploitation results in full account takeover. According to the Moodle Releases page, "Bug fixes for security issues in 3.11.x ended 11 December 2023." NOTE: This vulnerability only affects products that are no longer supported by the maintainer.
- Record
UBUNTU-CVE-2025-53021- CVSS 3.1
- 4.2 Medium
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:N - Updated
- 2026-11-02
OSVBIT-moodle-2025-53021 No score
A session fixation vulnerability in Moodle 3.x through 3.11.18 allows unauthenticated attackers to hijack user sessions via the sesskey parameter. The sesskey can be obtained without authentication and reused within the OAuth2 login flow, resulting in the victim's session being linked to the attacker's. Successful exploitation results in full account takeover. According to the Moodle Releases page, "Bug fixes for security issues in 3.11.x ended 11 December 2023." NOTE: This vulnerability only affects products that are no longer supported by the maintainer.
- Record
BIT-moodle-2025-53021- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
moodle/moodlePackagist |
3.0.0 to 3.11.18 | 4.0.0 |
moodleBitnami |
3.0.0 up to 4.1.10 | 4.1.10 |
moodle/moodlePackagist |
3.0.0 up to 4.0.0, plus listed versions v3.0.0v3.0.1v3.0.10v3.0.2v3.0.3 Show 45 moreShow lessv3.0.4v3.0.5v3.0.6v3.0.7v3.0.8v3.0.9v3.1.0v3.1.0-betav3.1.0-rc1v3.1.0-rc2v3.1.1v3.1.10v3.1.11v3.1.12v3.1.13v3.1.14v3.1.15v3.1.16v3.1.17v3.1.18v3.1.2v3.1.3v3.1.4v3.1.5v3.1.6v3.1.7v3.1.8v3.1.9v3.10.0v3.10.0-betav3.10.0-rc1v3.10.0-rc2v3.10.1v3.10.10v3.10.11v3.10.2v3.10.3v3.10.4v3.10.5v3.10.6v3.10.7v3.10.8v3.10.9v3.11.0v3.11.0-beta |
4.0.0 |
moodleUbuntu:Pro:16.04:LTS |
All versions, plus listed versions 2.7.9+dfsg-12.7.10+dfsg-12.7.11+dfsg-12.7.11+dfsg-22.7.12+dfsg-13.0.3+dfsg-0ubuntu13.0.3+dfsg-0ubuntu1+esm1 |
None known |
moodleUbuntu:Pro:18.04:LTS |
All versions, plus listed versions 3.0.3+dfsg-0ubuntu13.0.3+dfsg-0ubuntu1+esm1 |
None known |
History
| Recorded | Changed | Sources |
|---|---|---|
| first indexed | CVE List, EUVD, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2025-53021 is a medium vulnerability (CVSS 4.2) in Moodle, published June 24, 2025. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.37%, the 31st percentile. Fixed in moodle/moodle 4.0.0.
References
rentry.co/moodle-oauth2-cve
github.com/moodle/moodle/releases/tag/v3.11.18
moodledev.io/general/releases
nvd.nist.gov/vuln/detail/CVE-2025-53021
ubuntu.com/security/CVE-2025-53021
cve.org/CVERecord?id=CVE-2025-53021
Left out here: 160 versions. The JSON record has them.