CVE-2025-4513 Catalyst User Key Authentication Plugin Logout logout.php redirect
Attackers can redirect users to malicious sites via the logout page in the Catalyst User Key Authentication Plugin for Moodle.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- None listed
What is CVE-2025-4513?
CVE-2025-4513 is a medium-severity vulnerability in Catalyst User Key Authentication Plugin, published on 10 May 2025. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
A vulnerability classified as problematic was found in Catalyst User Key Authentication Plugin 20220819 on Moodle. Affected by this vulnerability is an unknown functionality of the file /auth/userkey/logout.php of the component Logout. The manipulation of the argument return leads to open redirect. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
Weakness: CWE-601
Which versions are affected by CVE-2025-4513?
How do I fix CVE-2025-4513?
No fix has been published for CVE-2025-4513 yet. Limit exposure of the affected software until one is available.
Is CVE-2025-4513 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2025-4513 exists.
Sources
Also known as GHSA-x598-7968-m6vh.