Moodle: moodle: open redirect vulnerability in oauth login flow allows redirection to malicious sites.

Vulnerability

Overview

CVE-2025-67852 describes an open redirect vulnerability in Moodle's OAuth login flow. The flaw stems from insufficient validation of redirect parameters after a user successfully authenticates via OAuth. This allows a remote attacker to craft a malicious login link that, once the user completes authentication, redirects them to an attacker-controlled URL instead of the intended destination [1][2].

Exploitation

An attacker can exploit this vulnerability by sending a specially crafted OAuth login URL to a victim. The victim must be a valid Moodle user who then authenticates through the OAuth flow. After successful authentication, the insufficient validation of the redirect parameter causes the browser to navigate to the attacker's site. No additional authentication or privileges are required beyond the user's normal session [2].

Impact

Successful exploitation enables phishing attacks, as the victim may be redirected to a page that mimics a legitimate Moodle interface, potentially leading to credential theft or information disclosure. The attacker could also use the redirect to exfiltrate session tokens or other sensitive data [1][2].

Mitigation

The Moodle project has addressed this issue in commit fa1624c8c9e3efa917f0e9d2666bb59d8be2a975, which restricts login redirects to local URLs [3]. Administrators should update their Moodle installations to the latest patched version to mitigate the risk. No workarounds have been publicly documented.