Moodle Self-Enrolment Vulnerability Bypassing Multi-Factor Authentication

A vulnerability in Moodle allows students to self-enrol in courses without completing all required safety checks, particularly in relation to multi-factor authentication (MFA). Affected users can sign up for courses before finishing the two-step verification process. This issue is present in Moodle versions 4.5 prior to 4.5.4, 4.4 prior to 4.4.8, and 4.3 prior to 4.3.12.

Impact

Exploitation of this vulnerability could lead to improper authentication, allowing users to bypass MFA requirements and enrol in courses prematurely.

Remediation

Users can upgrade to Moodle versions 4.5.4, 4.4.8, or 4.3.12 to address this vulnerability.