diff --git a/mod/lesson/mediafile.php b/mod/lesson/mediafile.php
index 71240f9bc29..897a20c067e 100644
--- a/mod/lesson/mediafile.php
+++ b/mod/lesson/mediafile.php
@@ -84,6 +84,7 @@ if (!$canmanage) {
     } else if ($lesson->usepassword && empty($USER->lessonloggedin[$lesson->id])) { // Password protected lesson code
         $correctpass = false;
         if (!empty($userpassword) && (($lesson->password == md5(trim($userpassword))) || ($lesson->password == trim($userpassword)))) {
+            require_sesskey();
             // with or without md5 for backward compatibility (MDL-11090)
             $USER->lessonloggedin[$lesson->id] = true;
             if ($lesson->highscores) {
diff --git a/mod/lesson/renderer.php b/mod/lesson/renderer.php
index 0a8dd036c43..406374e0b6d 100644
--- a/mod/lesson/renderer.php
+++ b/mod/lesson/renderer.php
@@ -113,6 +113,7 @@ class mod_lesson_renderer extends plugin_renderer_base {
         $output .=  '<form id="password" method="post" action="'.$CFG->wwwroot.'/mod/lesson/view.php" autocomplete="off">';
         $output .=  '<fieldset class="invisiblefieldset center">';
         $output .=  '<input type="hidden" name="id" value="'. $this->page->cm->id .'" />';
+        $output .=  '<input type="hidden" name="sesskey" value="'.sesskey().'" />';
         if ($failedattempt) {
             $output .=  $this->output->notification(get_string('loginfail', 'lesson'));
         }
diff --git a/mod/lesson/view.php b/mod/lesson/view.php
index a86b9788a62..6ec49df4f9e 100644
--- a/mod/lesson/view.php
+++ b/mod/lesson/view.php
@@ -83,6 +83,7 @@ if (!$canmanage) {
     } else if ($lesson->usepassword && empty($USER->lessonloggedin[$lesson->id])) { // Password protected lesson code
         $correctpass = false;
         if (!empty($userpassword) && (($lesson->password == md5(trim($userpassword))) || ($lesson->password == trim($userpassword)))) {
+            require_sesskey();
             // with or without md5 for backward compatibility (MDL-11090)
             $USER->lessonloggedin[$lesson->id] = true;
             if ($lesson->highscores) {