CVE-2025-62399: Moodle

High severity, CVSS 7.5. EPSS: 0.4% chance of exploitation in the next 30 days.

Moodle’s mobile and web service authentication endpoints did not sufficiently restrict repeated password attempts, making them susceptible to brute-force attacks.

Affected products

• Moodle Moodle: from 4.1.0, before 4.1.21 (fixed in 4.1.21); from 4.4.0, before 4.4.11 (fixed in 4.4.11); from 4.5.0, before 4.5.7 (fixed in 4.5.7); from 5.0.0, before 5.0.3 (fixed in 5.0.3)

Published 2025-10-23. Last modified 2026-06-17.