CAMP-2026-0002
TLS certificate verification disabled for LRS connection
Componentlogstore_xapi
SeverityHIGH
Affected versions<5.0.3
Fixed in5.0.3
Published2026-07-21T20:29:50Z
Fix released2026-07-20
Details
The plugin sent xAPI statements with CURLOPT_SSL_VERIFYPEER disabled, so an attacker able to intercept traffic between Moodle and the LRS could read learner activity data in transit, capture the LRS username and password from the Basic auth header, and tamper with responses. Fixed in 5.0.3, which enables certificate verification by default — including on upgraded sites that have not revisited the settings page. Administrators should upgrade to 5.0.3 or later and consider rotating LRS credentials if interception is a concern for their network path.