Description

A flaw was found in Moodle. Insufficient sanitization of username input on the password reset page allows a remote attacker to conduct a cross-site scripting (XSS) attack. By convincing an unauthenticated user to access a specially crafted password reset link, an attacker could execute arbitrary script in the victim's browser.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "4.3",
  "pubDate": "2026-09-30T09:17:15.897Z",
  "pubdate": "2026-09-30T09:17:15.897Z",
  "executiveSummary": "This vulnerability involves a Cross-Site Scripting (XSS) flaw identified within the Moodle password reset mechanism.\nThe issue arises from insufficient sanitization of the username input field, which allows for the injection of arbitrary malicious scripts.\nA remote, unauthenticated attacker can exploit this by crafting a specific URL that triggers the execution of script content within the context of a victim's web browser.\nSuccessful exploitation compromises the integrity of the user's session, potentially allowing unauthorized actions or data exfiltration by the attacker.\nThe risk is significant as it requires only that an unauthenticated victim visits the attacker-supplied link, bypassing authentication protections for the initial delivery phase.\nThis flaw underscores the necessity for robust input validation and context-aware output encoding on all user-controlled parameters, particularly in publicly accessible areas such as authentication or recovery modules.",
  "technicalDetails": "The root cause of this vulnerability is improper neutralization of input during the processing of username data on the Moodle password reset page. When a user navigates to the password recovery interface, the application fails to adequately sanitize or encode the username parameter before reflecting it back to the user within the HTML response. This failure permits the injection of malicious JavaScript sequences.\nThe exploitation flow begins when an attacker identifies the password reset endpoint and crafts a URL containing a payload within the username field. This payload is designed to be rendered by the victim's browser upon visiting the URL. Because the application reflects the username input without sufficient character filtering or context-specific encoding, the victim's browser interprets the injected script as legitimate site content.\nThis is a Reflected Cross-Site Scripting (XSS) attack. No authentication is required for the attacker to initiate this request, and the vulnerability is exposed via the web interface over the network. The attacker must leverage social engineering to convince the victim to click the malicious link. Once the victim interacts with the link, the browser executes the attacker's script in the context of the Moodle domain. This allows the script to access cookies, local storage, and perform actions on behalf of the authenticated or unauthenticated user within the Moodle environment.\nThe impact of the script execution is broad, as it allows the attacker to conduct session hijacking, exfiltrate sensitive information stored in the browser, or modify the rendered content of the Moodle page to conduct further phishing or credential harvesting. Because the script executes within the security origin of the Moodle site, it bypasses the Same-Origin Policy (SOP) constraints typically protecting user data. The vulnerability persists as long as the underlying input processing logic remains unpatched to handle encoded inputs or utilize strict input allowlisting."
}