Session Fixation Vulnerability in Moodle by Moodle Pty Ltd

CVE-2025-53021

What is CVE-2025-53021?

A session fixation vulnerability exists in Moodle versions 3.x through 3.11.18, enabling unauthenticated attackers to hijack user sessions via the 'sesskey' parameter. Attackers can obtain the 'sesskey' without authentication and exploit it during the OAuth2 login flow to link the victim's session to their own. This could lead to unauthorized access, allowing attackers complete control over user accounts. It's important to note that this vulnerability affects only those products that are no longer supported by the maintainer.

References