Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
4.3
CVE-2026-102586: Moodle password reset link can run unwanted script
CVE-2026-102586 · published 1 month ago
Summary
Moodle's password reset page does not properly clean the username that appears in the link. An attacker could send a specially crafted reset link to a user, causing the user's browser to run any code the attacker chooses. Update Moodle to the latest version or apply the provided patch to fix the issue.
What to do
- Update moodle to version 5.2.2.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| Ubuntu:Pro:16.04:LTS | canonical | moodle | All versions |
| – | moodle | moodle |
< 4.5.13 >= 5.0.0, < 5.0.9 >= 5.1.0, < 5.1.6 >= 5.2.0, < 5.2.2 cpe:2.3:a:moodle:moodle:*:*:*:*:*:*:*:* |
| Bitnami | – | moodle |
>= 5.2.0, < 5.2.2 Fix: upgrade to 5.2.2
|
Original advisory text
Moodle: xss via password reset link due to insufficient username escaping
A flaw was found in Moodle. Insufficient sanitization of username input on the password reset page allows a remote attacker to conduct a cross-site scripting (XSS) attack. By convincing an unauthenticated user to access a specially crafted password reset link, an attacker could execute arbitrary script in the victim's browser.
References
- http://git.moodle.org/gw?p=moodle.git&a=search&h=HEAD&st=commit&s=MDL-88335 URL
- https://moodle.org/mod/forum/discuss.php?d=482504 URL
- https://access.redhat.com/security/cve/CVE-2026-102586 Vendor Advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=2543641 Third Party Advisory
- https://ubuntu.com/security/CVE-2026-102586 Third Party Advisory
- https://www.cve.org/CVERecord?id=CVE-2026-102586 Third Party Advisory
- https://git.moodle.org URL
- https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/102xxx/CVE-2026-1025... Vendor Advisory
- https://nvd.nist.gov/vuln/detail/CVE-2026-102586 Vendor Advisory
Internet-facing
60 days
Internal
At next upgrade
- Not known to be exploited
- Needs hands-on effort to exploit (estimated)
- Gives an attacker partial control (estimated)
Type
CWE-79Cross-site Scripting (XSS)
Timeline
Published30 Sep 2026
Updated3 Nov 2026
First seen30 Sep 2026
Sources
CVE-2026-102586 · NVD
CVE-2026-102586 · MITRE
UBUNTU-CVE-2026-102586 · OSV
CVE-2026-102586 · OSV
BIT-moodle-2026-102586 · OSV
Track software like this
Free during beta