CVE-2024-38277 is a vulnerability in Moodle where the QR login key and the auto-login key for the Moodle mobile app are not generated as separate unique keys. This allows the same key to be used interchangeably between QR login and auto-login, which is not intended behavior. The issue affects multiple Moodle versions prior to specific patch releases. A patch is available to address this issue.