CVE-2026-102586 PUBLISHED

Moodle: xss via password reset link due to insufficient username escaping

Assigner: fedora
Reserved: 29.09.2026 Published: 30.09.2026 Updated: 30.09.2026

A flaw was found in Moodle. Insufficient sanitization of username input on the password reset page allows a remote attacker to conduct a cross-site scripting (XSS) attack. By convincing an unauthenticated user to access a specially crafted password reset link, an attacker could execute arbitrary script in the victim's browser.

Metrics

CVSS 3.1

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N
CVSS Score: 4.3

Attack Vector	Network	Scope	Unchanged
Attack Complexity	Low	Confidentiality Impact	Low
Privileges Required	None	Integrity Impact	None
User Interaction	Required	Availability Impact	None

CVSS 3.1

Product Status

Package Collection	https://git.moodle.org
Package Name	moodle
Versions	Default: unaffected affected from 5.2.0 to 5.2.2 (excl.) affected from 5.1.0 to 5.1.6 (excl.) affected from 5.0.0 to 5.0.9 (excl.) affected from 0 to 4.5.13 (excl.)

Credits

Upstream acknowledges Henk van den Toorn as the original reporter.

References

Problem Types

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') CWE