Skip to main content
CVE-2024-38277VulnerabilityPublished Updated

CVE-2024-38277: QR login key and auto-login key for the Moodle mobile app should be generated as separate keys

Affects moodleSource GCVE Database

0

Not known to be exploited · fixed in 4.4.1 : update moodle when convenient.

Data as of 25 Oct 2026, 19:02 UTC

Severity
Medium

Rated by Threat Radar · No CVSS score from NVD or the CNA

EPSS
0.2% chance of exploitation in 30 days – higher than 15% of CVEsExploit Prediction Scoring System: the likelihood attackers will use this flaw soon.
Patch
Available – fixed in 4.4.1, 4.3.5, 4.2.8 +1

Exploitation evidence

  1. Disclosed: evidence found.

    CVE published 8 Aug 2025

  2. Detectable: no evidence on record.

    No public nuclei template indexed

  3. Weaponised: no evidence on record.

    No public exploit code indexed in Metasploit or Exploit-DB

  4. Exploited in the wild: no evidence on record.

    Not in CISA KEV and no source reports exploitation

  5. Observed by OffSeq Mirage: no evidence on record.

    No attack traffic recorded by OffSeq Mirage sensors

A missing step is not evidence of safety. Sources: cve.org (opens in a new tab), the Metasploit, Exploit-DB and nuclei-templates index as of 2026-10-25.

What to do

Upgrade moodle to 4.4.1, 4.3.5, 4.2.8 or 4.1.11.

Affected software

ProductAffectedFixed in
Bitnamimoodlepkg:bitnami/moodleOther threatsAffected
  • >=4.1.0 <4.1.11
  • >=4.2.0 <4.2.8
  • >=4.3.0 <4.3.5
  • >=4.4.0 <4.4.1
Fixed in
  • 4.1.11
  • 4.2.8
  • 4.3.5
  • 4.4.1

Check your own hosts for these packages with threat-finder (opens in a new tab), our free open-source scanner.

AI-suggested

A patch is available for this vulnerability. Users should upgrade to Moodle versions 4.1.11 or later, 4.2.8 or later, 4.3.5 or later, or 4.4.1 or later to ensure that QR login keys and auto-login keys are generated separately. Applying the official patch resolves the issue.

Description

CVE-2024-38277 is a vulnerability in Moodle where the QR login key and the auto-login key for the Moodle mobile app are not generated as separate unique keys. This allows the same key to be used interchangeably between QR login and auto-login, which is not intended behavior. The issue affects multiple Moodle versions prior to specific patch releases. A patch is available to address this issue.

References

Community reviews

Loading reviews…