Search
Find a vulnerability
Search criteria
ⓘ
Use this form to refine search results.
Full-text search supports keyword queries with ranking and filtering.
You can combine vendor, product, and sources to narrow results.
Enable “Apply ordering” to sort by date instead of relevance.
14 vulnerabilities found for openedx-platform by openedx
CVE-2026-55421 (GCVE-0-2026-55421)
Vulnerability from nvd – Published: 2026-09-02 16:54 – Updated: 2026-09-04 02:47
VLAI
EPSS
VEX
Title
Open edX Platform: SSRF in Studio Video Download Endpoint
Summary
Open edX Platform enables the authoring and delivery of online learning at any scale. Prior to commit 00b7c3c, the endpoint accepts user-supplied files[].url, performs a server-side fetch using "requests.get(url, allow_redirects=True)". The fetched bytes are then returned inside a ZIP response. This enables SSRF with response exfiltration. Redirect-following is enabled, and there is no timeout in the vulnerable fetch path. This issue has been patched via commit 00b7c3c.
Severity
6.8 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-04 02:46 UTC
CWE
- CWE-918 - Server-Side Request Forgery (SSRF)
Assigner
References
4 references
| URL | Tags |
|---|---|
| https://github.com/openedx/openedx-platform/secur… | x_refsource_CONFIRM |
| https://github.com/openedx/openedx-platform/commi… | x_refsource_MISC |
| https://github.com/openedx/openedx-platform/commi… | x_refsource_MISC |
| https://github.com/openedx/openedx-platform/commi… | x_refsource_MISC |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| openedx | openedx-platform |
Affected:
< 00b7c3ce418b487c5696b064fc5033594b045e75
|
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-55421",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-04T02:46:57.837297Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-09-04T02:47:09.436Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "openedx-platform",
"vendor": "openedx",
"versions": [
{
"status": "affected",
"version": "\u003c 00b7c3ce418b487c5696b064fc5033594b045e75"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Open edX Platform enables the authoring and delivery of online learning at any scale. Prior to commit 00b7c3c, the endpoint accepts user-supplied files[].url, performs a server-side fetch using \"requests.get(url, allow_redirects=True)\". The fetched bytes are then returned inside a ZIP response. This enables SSRF with response exfiltration. Redirect-following is enabled, and there is no timeout in the vulnerable fetch path. This issue has been patched via commit 00b7c3c."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 6.8,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "HIGH",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-918",
"description": "CWE-918: Server-Side Request Forgery (SSRF)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-02T16:54:28.818Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/openedx/openedx-platform/security/advisories/GHSA-fpf9-9rpr-jvrx",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/openedx/openedx-platform/security/advisories/GHSA-fpf9-9rpr-jvrx"
},
{
"name": "https://github.com/openedx/openedx-platform/commit/00b7c3ce418b487c5696b064fc5033594b045e75",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/openedx/openedx-platform/commit/00b7c3ce418b487c5696b064fc5033594b045e75"
},
{
"name": "https://github.com/openedx/openedx-platform/commit/241b914a191ec24658b9cde75a7114db40a5d53a",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/openedx/openedx-platform/commit/241b914a191ec24658b9cde75a7114db40a5d53a"
},
{
"name": "https://github.com/openedx/openedx-platform/commit/c9831c2c9f53b7aa9a61d80e6d91a9941ce52ec6",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/openedx/openedx-platform/commit/c9831c2c9f53b7aa9a61d80e6d91a9941ce52ec6"
}
],
"source": {
"advisory": "GHSA-fpf9-9rpr-jvrx",
"discovery": "UNKNOWN"
},
"title": "Open edX Platform: SSRF in Studio Video Download Endpoint"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-55421",
"datePublished": "2026-09-02T16:54:28.818Z",
"dateReserved": "2026-06-16T21:48:43.125Z",
"dateUpdated": "2026-09-04T02:47:09.436Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-53636 (GCVE-0-2026-53636)
Vulnerability from nvd – Published: 2026-09-02 16:54 – Updated: 2026-09-02 18:03
VLAI
EPSS
VEX
Title
Open edX LTI OAuth Replay Attack
Summary
Open edX Platform enables the authoring and delivery of online learning at any scale. Prior to commit 3a5ac85, a security vulnerability has been identified in the Open edX LMS platform's LTI (Learning Tools Interoperability) Provider implementation. The validate_timestamp_and_nonce function in lms/djangoapps/lti_provider/signature_validator.py does not validate OAuth nonces or timestamps, allowing an attacker who captures a valid LTI launch request to replay it an unlimited number of times without detection. This issue has been patched via commit 3a5ac85.
Severity
4.7 (Medium)
SSVC
Exploitation: poc
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-02 18:03 UTC
CWE
- CWE-294 - Authentication Bypass by Capture-replay
Assigner
References
4 references
| URL | Tags |
|---|---|
| https://github.com/openedx/openedx-platform/secur… | x_refsource_CONFIRM |
| https://github.com/openedx/openedx-platform/commi… | x_refsource_MISC |
| https://github.com/openedx/openedx-platform/commi… | x_refsource_MISC |
| https://github.com/openedx/openedx-platform/commi… | x_refsource_MISC |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| openedx | openedx-platform |
Affected:
< 3a5ac856c79557c5c74d8b3e6578f289d7cceecd
|
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-53636",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-02T18:03:21.512059Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-09-02T18:03:41.926Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"references": [
{
"tags": [
"exploit"
],
"url": "https://github.com/openedx/openedx-platform/security/advisories/GHSA-6gm5-c49g-p3h9"
}
],
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "openedx-platform",
"vendor": "openedx",
"versions": [
{
"status": "affected",
"version": "\u003c 3a5ac856c79557c5c74d8b3e6578f289d7cceecd"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Open edX Platform enables the authoring and delivery of online learning at any scale. Prior to commit 3a5ac85, a security vulnerability has been identified in the Open edX LMS platform\u0027s LTI (Learning Tools Interoperability) Provider implementation. The validate_timestamp_and_nonce function in lms/djangoapps/lti_provider/signature_validator.py does not validate OAuth nonces or timestamps, allowing an attacker who captures a valid LTI launch request to replay it an unlimited number of times without detection. This issue has been patched via commit 3a5ac85."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 4.7,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "CHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-294",
"description": "CWE-294: Authentication Bypass by Capture-replay",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-02T16:54:10.403Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/openedx/openedx-platform/security/advisories/GHSA-6gm5-c49g-p3h9",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/openedx/openedx-platform/security/advisories/GHSA-6gm5-c49g-p3h9"
},
{
"name": "https://github.com/openedx/openedx-platform/commit/0a92cf25de8844bf840ffd5d18dcfd940031a2ba",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/openedx/openedx-platform/commit/0a92cf25de8844bf840ffd5d18dcfd940031a2ba"
},
{
"name": "https://github.com/openedx/openedx-platform/commit/3a5ac856c79557c5c74d8b3e6578f289d7cceecd",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/openedx/openedx-platform/commit/3a5ac856c79557c5c74d8b3e6578f289d7cceecd"
},
{
"name": "https://github.com/openedx/openedx-platform/commit/50af17b05d82a8c7e8e690cc2783a8a0ba330bc3",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/openedx/openedx-platform/commit/50af17b05d82a8c7e8e690cc2783a8a0ba330bc3"
}
],
"source": {
"advisory": "GHSA-6gm5-c49g-p3h9",
"discovery": "UNKNOWN"
},
"title": "Open edX LTI OAuth Replay Attack"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-53636",
"datePublished": "2026-09-02T16:54:10.403Z",
"dateReserved": "2026-06-09T20:16:59.647Z",
"dateUpdated": "2026-09-02T18:03:41.926Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-53635 (GCVE-0-2026-53635)
Vulnerability from nvd – Published: 2026-09-02 16:53 – Updated: 2026-09-02 18:03
VLAI
EPSS
VEX
Title
Open edX Platform: Insufficient Permission on set_course_mode_price()
Summary
Open edX Platform enables the authoring and delivery of online learning at any scale. Prior to commit 59bb6d6, the view function set_course_mode_price() at lms/djangoapps/instructor/views/instructor_dashboard.py:430 is decorated only with @login_required and performs no course-level permission check. Any authenticated user — including a learner account with zero course roles — can issue a single POST request to overwrite the honor mode price and currency of any course on the platform. The companion frontend modal was removed in a prior cleanup, but the URL route and view remain live, making this an unguarded orphan endpoint. This issue has been patched via commit 59bb6d6.
Severity
7.6 (High)
SSVC
Exploitation: poc
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-02 18:03 UTC
CWE
- CWE-862 - Missing Authorization
Assigner
References
4 references
| URL | Tags |
|---|---|
| https://github.com/openedx/openedx-platform/secur… | x_refsource_CONFIRM |
| https://github.com/openedx/openedx-platform/commi… | x_refsource_MISC |
| https://github.com/openedx/openedx-platform/commi… | x_refsource_MISC |
| https://github.com/openedx/openedx-platform/commi… | x_refsource_MISC |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| openedx | openedx-platform |
Affected:
< 59bb6d669e4fdc24d96afb809e12119372d9e257
|
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-53635",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-02T18:03:00.881308Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-09-02T18:03:26.341Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"references": [
{
"tags": [
"exploit"
],
"url": "https://github.com/openedx/openedx-platform/security/advisories/GHSA-rqq6-w4pv-7pjv"
}
],
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "openedx-platform",
"vendor": "openedx",
"versions": [
{
"status": "affected",
"version": "\u003c 59bb6d669e4fdc24d96afb809e12119372d9e257"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Open edX Platform enables the authoring and delivery of online learning at any scale. Prior to commit 59bb6d6, the view function set_course_mode_price() at lms/djangoapps/instructor/views/instructor_dashboard.py:430 is decorated only with @login_required and performs no course-level permission check. Any authenticated user \u2014 including a learner account with zero course roles \u2014 can issue a single POST request to overwrite the honor mode price and currency of any course on the platform. The companion frontend modal was removed in a prior cleanup, but the URL route and view remain live, making this an unguarded orphan endpoint. This issue has been patched via commit 59bb6d6."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "LOW",
"baseScore": 7.6,
"baseSeverity": "HIGH",
"confidentialityImpact": "LOW",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:L",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-862",
"description": "CWE-862: Missing Authorization",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-02T16:53:36.102Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/openedx/openedx-platform/security/advisories/GHSA-rqq6-w4pv-7pjv",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/openedx/openedx-platform/security/advisories/GHSA-rqq6-w4pv-7pjv"
},
{
"name": "https://github.com/openedx/openedx-platform/commit/59bb6d669e4fdc24d96afb809e12119372d9e257",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/openedx/openedx-platform/commit/59bb6d669e4fdc24d96afb809e12119372d9e257"
},
{
"name": "https://github.com/openedx/openedx-platform/commit/f25bbc4d52bd827c8f04c73de427e2e16a144c73",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/openedx/openedx-platform/commit/f25bbc4d52bd827c8f04c73de427e2e16a144c73"
},
{
"name": "https://github.com/openedx/openedx-platform/commit/fd93ef5f9940f4ad6f50cf7faecad8d9cf2d3336",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/openedx/openedx-platform/commit/fd93ef5f9940f4ad6f50cf7faecad8d9cf2d3336"
}
],
"source": {
"advisory": "GHSA-rqq6-w4pv-7pjv",
"discovery": "UNKNOWN"
},
"title": "Open edX Platform: Insufficient Permission on set_course_mode_price()"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-53635",
"datePublished": "2026-09-02T16:53:36.102Z",
"dateReserved": "2026-06-09T20:16:59.647Z",
"dateUpdated": "2026-09-02T18:03:26.341Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-42858 (GCVE-0-2026-42858)
Vulnerability from nvd – Published: 2026-05-11 17:30 – Updated: 2026-05-12 16:16
VLAI
EPSS
VEX
Title
Open edX Platform: Server-Side Request Forgery (SSRF) in SAML Provider Data Sync Endpoint
Summary
Open edX Platform enables the authoring and delivery of online learning at any scale. The sync_provider_data endpoint in SAMLProviderDataViewSet allows authenticated Enterprise Admin users to supply an arbitrary URL via the metadata_url POST parameter. This URL is passed directly to requests.get() in fetch_metadata_xml() without any URL validation, IP filtering, or scheme enforcement. An attacker with Enterprise Admin privileges can force the server to make HTTP requests to internal network services, cloud metadata endpoints (e.g., AWS 169.254.169.254), or other attacker-controlled destinations. This vulnerability is fixed by commit 6fda1f120ff5a590d120ae1180185525f399c6d0 and 70a56246dd9c9df57c596e64bdd8a11b1d9da054.
Severity
8.5 (High)
SSVC
Exploitation: poc
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-05-12 16:16 UTC
CWE
- CWE-918 - Server-Side Request Forgery (SSRF)
Assigner
References
3 references
| URL | Tags |
|---|---|
| https://github.com/openedx/openedx-platform/secur… | x_refsource_CONFIRM |
| https://github.com/openedx/openedx-platform/commi… | x_refsource_MISC |
| https://github.com/openedx/openedx-platform/commi… | x_refsource_MISC |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| openedx | openedx-platform |
Affected:
< 6fda1f120ff5a590d120ae1180185525f399c6d0
|
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-42858",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-05-12T16:16:17.343622Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-05-12T16:16:54.596Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"references": [
{
"tags": [
"exploit"
],
"url": "https://github.com/openedx/openedx-platform/security/advisories/GHSA-328g-7h4g-r2m9"
}
],
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "openedx-platform",
"vendor": "openedx",
"versions": [
{
"status": "affected",
"version": "\u003c 6fda1f120ff5a590d120ae1180185525f399c6d0"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Open edX Platform enables the authoring and delivery of online learning at any scale. The sync_provider_data endpoint in SAMLProviderDataViewSet allows authenticated Enterprise Admin users to supply an arbitrary URL via the metadata_url POST parameter. This URL is passed directly to requests.get() in fetch_metadata_xml() without any URL validation, IP filtering, or scheme enforcement. An attacker with Enterprise Admin privileges can force the server to make HTTP requests to internal network services, cloud metadata endpoints (e.g., AWS 169.254.169.254), or other attacker-controlled destinations. This vulnerability is fixed by commit 6fda1f120ff5a590d120ae1180185525f399c6d0 and 70a56246dd9c9df57c596e64bdd8a11b1d9da054."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 8.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "LOW",
"privilegesRequired": "LOW",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-918",
"description": "CWE-918: Server-Side Request Forgery (SSRF)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-05-11T17:30:59.724Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/openedx/openedx-platform/security/advisories/GHSA-328g-7h4g-r2m9",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/openedx/openedx-platform/security/advisories/GHSA-328g-7h4g-r2m9"
},
{
"name": "https://github.com/openedx/openedx-platform/commit/6fda1f120ff5a590d120ae1180185525f399c6d0",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/openedx/openedx-platform/commit/6fda1f120ff5a590d120ae1180185525f399c6d0"
},
{
"name": "https://github.com/openedx/openedx-platform/commit/70a56246dd9c9df57c596e64bdd8a11b1d9da054",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/openedx/openedx-platform/commit/70a56246dd9c9df57c596e64bdd8a11b1d9da054"
}
],
"source": {
"advisory": "GHSA-328g-7h4g-r2m9",
"discovery": "UNKNOWN"
},
"title": "Open edX Platform: Server-Side Request Forgery (SSRF) in SAML Provider Data Sync Endpoint"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-42858",
"datePublished": "2026-05-11T17:30:59.724Z",
"dateReserved": "2026-04-30T16:44:48.379Z",
"dateUpdated": "2026-05-12T16:16:54.596Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-42857 (GCVE-0-2026-42857)
Vulnerability from nvd – Published: 2026-05-11 17:32 – Updated: 2026-05-13 14:40
VLAI
EPSS
VEX
Title
Open edX Platform: Stored CSS Injection in Email Notifications via Incomplete HTML Sanitization
Summary
Open edX Platform enables the authoring and delivery of online learning at any scale. The HTML sanitizer clean_thread_html_body() used for discussion notification emails fails to remove <style> tags from user-generated discussion post content. This content is rendered with Django's |safe template filter in email notification templates, allowing any enrolled student to inject arbitrary CSS into email notifications sent to other users. This enables email tracking (IP address disclosure), content spoofing, and phishing attacks. This vulnerability is fixed with commit cddc25cd791bb78f76833896e4778f668861df12.
Severity
4.6 (Medium)
SSVC
Exploitation: poc
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-05-13 12:50 UTC
CWE
- CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Assigner
References
2 references
| URL | Tags |
|---|---|
| https://github.com/openedx/openedx-platform/secur… | x_refsource_CONFIRM |
| https://github.com/openedx/openedx-platform/commi… | x_refsource_MISC |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| openedx | openedx-platform |
Affected:
< cddc25cd791bb78f76833896e4778f668861df12
Affected: >= sumac, < ulmo |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-42857",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-05-13T12:50:59.990504Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-05-13T14:40:55.961Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"references": [
{
"tags": [
"exploit"
],
"url": "https://github.com/openedx/openedx-platform/security/advisories/GHSA-4xv3-5j4x-q8g4"
}
],
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "openedx-platform",
"vendor": "openedx",
"versions": [
{
"status": "affected",
"version": "\u003c cddc25cd791bb78f76833896e4778f668861df12"
},
{
"status": "affected",
"version": "\u003e= sumac, \u003c ulmo"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Open edX Platform enables the authoring and delivery of online learning at any scale. The HTML sanitizer clean_thread_html_body() used for discussion notification emails fails to remove \u003cstyle\u003e tags from user-generated discussion post content. This content is rendered with Django\u0027s |safe template filter in email notification templates, allowing any enrolled student to inject arbitrary CSS into email notifications sent to other users. This enables email tracking (IP address disclosure), content spoofing, and phishing attacks. This vulnerability is fixed with commit cddc25cd791bb78f76833896e4778f668861df12."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 4.6,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-79",
"description": "CWE-79: Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-05-11T17:32:40.940Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/openedx/openedx-platform/security/advisories/GHSA-4xv3-5j4x-q8g4",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/openedx/openedx-platform/security/advisories/GHSA-4xv3-5j4x-q8g4"
},
{
"name": "https://github.com/openedx/openedx-platform/commit/cddc25cd791bb78f76833896e4778f668861df12",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/openedx/openedx-platform/commit/cddc25cd791bb78f76833896e4778f668861df12"
}
],
"source": {
"advisory": "GHSA-4xv3-5j4x-q8g4",
"discovery": "UNKNOWN"
},
"title": "Open edX Platform: Stored CSS Injection in Email Notifications via Incomplete HTML Sanitization"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-42857",
"datePublished": "2026-05-11T17:32:40.940Z",
"dateReserved": "2026-04-30T16:44:48.379Z",
"dateUpdated": "2026-05-13T14:40:55.961Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-35404 (GCVE-0-2026-35404)
Vulnerability from nvd – Published: 2026-04-06 21:22 – Updated: 2026-05-11 17:29
VLAI
EPSS
VEX
Title
Open edX Platform has an Open Redirect in Survey Views via Unvalidated redirect_url Parameter
Summary
Open edX Platform enables the authoring and delivery of online learning at any scale. The view_survey endpoint accepts a redirect_url GET parameter that is passed directly to HttpResponseRedirect() without any URL validation. When a non-existent survey name is provided, the server issues an immediate HTTP 302 redirect to the attacker-controlled URL. Additionally, the same unvalidated URL is embedded in a hidden form field and returned in a JSON response after form submission, where client-side JavaScript performs location.href = url. This enables phishing and credential theft attacks against authenticated Open edX users. This vulnerability is fixed with commit 76462f1e5fa9b37d2621ad7ad19514b403908970.
Severity
4.7 (Medium)
SSVC
Exploitation: poc
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-04-07 16:17 UTC
CWE
- CWE-601 - URL Redirection to Untrusted Site ('Open Redirect')
Assigner
References
2 references
| URL | Tags |
|---|---|
| https://github.com/openedx/openedx-platform/secur… | x_refsource_CONFIRM |
| https://github.com/openedx/openedx-platform/commi… | x_refsource_MISC |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| openedx | openedx-platform |
Affected:
< 76462f1e5fa9b37d2621ad7ad19514b403908970
|
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-35404",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-04-07T16:17:36.155139Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-04-07T16:17:47.603Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "openedx-platform",
"vendor": "openedx",
"versions": [
{
"status": "affected",
"version": "\u003c 76462f1e5fa9b37d2621ad7ad19514b403908970"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Open edX Platform enables the authoring and delivery of online learning at any scale. The view_survey endpoint accepts a redirect_url GET parameter that is passed directly to HttpResponseRedirect() without any URL validation. When a non-existent survey name is provided, the server issues an immediate HTTP 302 redirect to the attacker-controlled URL. Additionally, the same unvalidated URL is embedded in a hidden form field and returned in a JSON response after form submission, where client-side JavaScript performs location.href = url. This enables phishing and credential theft attacks against authenticated Open edX users. This vulnerability is fixed with commit 76462f1e5fa9b37d2621ad7ad19514b403908970."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 4.7,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "CHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:N/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-601",
"description": "CWE-601: URL Redirection to Untrusted Site (\u0027Open Redirect\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-05-11T17:29:17.591Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/openedx/openedx-platform/security/advisories/GHSA-2843-x998-f8r2",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/openedx/openedx-platform/security/advisories/GHSA-2843-x998-f8r2"
},
{
"name": "https://github.com/openedx/openedx-platform/commit/76462f1e5fa9b37d2621ad7ad19514b403908970",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/openedx/openedx-platform/commit/76462f1e5fa9b37d2621ad7ad19514b403908970"
}
],
"source": {
"advisory": "GHSA-2843-x998-f8r2",
"discovery": "UNKNOWN"
},
"title": "Open edX Platform has an Open Redirect in Survey Views via Unvalidated redirect_url Parameter"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-35404",
"datePublished": "2026-04-06T21:22:29.562Z",
"dateReserved": "2026-04-02T17:03:42.074Z",
"dateUpdated": "2026-05-11T17:29:17.591Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-34736 (GCVE-0-2026-34736)
Vulnerability from nvd – Published: 2026-04-02 18:29 – Updated: 2026-04-03 16:08
VLAI
EPSS
VEX
Title
Open edX Platform: Account Activation Bypass via activation_key Exposure in REST API
Summary
Open edX Platform enables the authoring and delivery of online learning at any scale. From the maple release to before the ulmo release, an unauthenticated attacker can fully bypass the email verification process by combining two issues: the OAuth2 password grant issuing tokens to inactive users (documented behavior) and the activation_key being exposed in the REST API response at /api/user/v1/accounts/. This issue has been patched in the ulmo release.
Severity
5.3 (Medium)
SSVC
Exploitation: poc
Automatable: yes
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-04-03 15:48 UTC
CWE
- CWE-287 - Improper Authentication
Assigner
References
2 references
| URL | Tags |
|---|---|
| https://github.com/openedx/openedx-platform/secur… | x_refsource_CONFIRM |
| https://github.com/openedx/openedx-platform/commi… | x_refsource_MISC |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| openedx | openedx-platform |
Affected:
>= maple, < ulmo
|
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-34736",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-04-03T15:48:43.267069Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-04-03T16:08:43.532Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "openedx-platform",
"vendor": "openedx",
"versions": [
{
"status": "affected",
"version": "\u003e= maple, \u003c ulmo"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Open edX Platform enables the authoring and delivery of online learning at any scale. From the maple release to before the ulmo release, an unauthenticated attacker can fully bypass the email verification process by combining two issues: the OAuth2 password grant issuing tokens to inactive users (documented behavior) and the activation_key being exposed in the REST API response at /api/user/v1/accounts/. This issue has been patched in the ulmo release."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-287",
"description": "CWE-287: Improper Authentication",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-04-02T18:29:01.740Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/openedx/openedx-platform/security/advisories/GHSA-m6rg-rp98-4crw",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/openedx/openedx-platform/security/advisories/GHSA-m6rg-rp98-4crw"
},
{
"name": "https://github.com/openedx/openedx-platform/commit/ad342ae16e6af0b46460ca05f47697ac755feba8",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/openedx/openedx-platform/commit/ad342ae16e6af0b46460ca05f47697ac755feba8"
}
],
"source": {
"advisory": "GHSA-m6rg-rp98-4crw",
"discovery": "UNKNOWN"
},
"title": "Open edX Platform: Account Activation Bypass via activation_key Exposure in REST API"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-34736",
"datePublished": "2026-04-02T18:29:01.740Z",
"dateReserved": "2026-03-30T18:41:20.754Z",
"dateUpdated": "2026-04-03T16:08:43.532Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-55421 (GCVE-0-2026-55421)
Vulnerability from cvelistv5 – Published: 2026-09-02 16:54 – Updated: 2026-09-04 02:47
VLAI
EPSS
VEX
Title
Open edX Platform: SSRF in Studio Video Download Endpoint
Summary
Open edX Platform enables the authoring and delivery of online learning at any scale. Prior to commit 00b7c3c, the endpoint accepts user-supplied files[].url, performs a server-side fetch using "requests.get(url, allow_redirects=True)". The fetched bytes are then returned inside a ZIP response. This enables SSRF with response exfiltration. Redirect-following is enabled, and there is no timeout in the vulnerable fetch path. This issue has been patched via commit 00b7c3c.
Severity
6.8 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-04 02:46 UTC
CWE
- CWE-918 - Server-Side Request Forgery (SSRF)
Assigner
References
4 references
| URL | Tags |
|---|---|
| https://github.com/openedx/openedx-platform/secur… | x_refsource_CONFIRM |
| https://github.com/openedx/openedx-platform/commi… | x_refsource_MISC |
| https://github.com/openedx/openedx-platform/commi… | x_refsource_MISC |
| https://github.com/openedx/openedx-platform/commi… | x_refsource_MISC |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| openedx | openedx-platform |
Affected:
< 00b7c3ce418b487c5696b064fc5033594b045e75
|
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-55421",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-04T02:46:57.837297Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-09-04T02:47:09.436Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "openedx-platform",
"vendor": "openedx",
"versions": [
{
"status": "affected",
"version": "\u003c 00b7c3ce418b487c5696b064fc5033594b045e75"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Open edX Platform enables the authoring and delivery of online learning at any scale. Prior to commit 00b7c3c, the endpoint accepts user-supplied files[].url, performs a server-side fetch using \"requests.get(url, allow_redirects=True)\". The fetched bytes are then returned inside a ZIP response. This enables SSRF with response exfiltration. Redirect-following is enabled, and there is no timeout in the vulnerable fetch path. This issue has been patched via commit 00b7c3c."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 6.8,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "HIGH",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-918",
"description": "CWE-918: Server-Side Request Forgery (SSRF)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-02T16:54:28.818Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/openedx/openedx-platform/security/advisories/GHSA-fpf9-9rpr-jvrx",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/openedx/openedx-platform/security/advisories/GHSA-fpf9-9rpr-jvrx"
},
{
"name": "https://github.com/openedx/openedx-platform/commit/00b7c3ce418b487c5696b064fc5033594b045e75",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/openedx/openedx-platform/commit/00b7c3ce418b487c5696b064fc5033594b045e75"
},
{
"name": "https://github.com/openedx/openedx-platform/commit/241b914a191ec24658b9cde75a7114db40a5d53a",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/openedx/openedx-platform/commit/241b914a191ec24658b9cde75a7114db40a5d53a"
},
{
"name": "https://github.com/openedx/openedx-platform/commit/c9831c2c9f53b7aa9a61d80e6d91a9941ce52ec6",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/openedx/openedx-platform/commit/c9831c2c9f53b7aa9a61d80e6d91a9941ce52ec6"
}
],
"source": {
"advisory": "GHSA-fpf9-9rpr-jvrx",
"discovery": "UNKNOWN"
},
"title": "Open edX Platform: SSRF in Studio Video Download Endpoint"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-55421",
"datePublished": "2026-09-02T16:54:28.818Z",
"dateReserved": "2026-06-16T21:48:43.125Z",
"dateUpdated": "2026-09-04T02:47:09.436Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-53636 (GCVE-0-2026-53636)
Vulnerability from cvelistv5 – Published: 2026-09-02 16:54 – Updated: 2026-09-02 18:03
VLAI
EPSS
VEX
Title
Open edX LTI OAuth Replay Attack
Summary
Open edX Platform enables the authoring and delivery of online learning at any scale. Prior to commit 3a5ac85, a security vulnerability has been identified in the Open edX LMS platform's LTI (Learning Tools Interoperability) Provider implementation. The validate_timestamp_and_nonce function in lms/djangoapps/lti_provider/signature_validator.py does not validate OAuth nonces or timestamps, allowing an attacker who captures a valid LTI launch request to replay it an unlimited number of times without detection. This issue has been patched via commit 3a5ac85.
Severity
4.7 (Medium)
SSVC
Exploitation: poc
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-02 18:03 UTC
CWE
- CWE-294 - Authentication Bypass by Capture-replay
Assigner
References
4 references
| URL | Tags |
|---|---|
| https://github.com/openedx/openedx-platform/secur… | x_refsource_CONFIRM |
| https://github.com/openedx/openedx-platform/commi… | x_refsource_MISC |
| https://github.com/openedx/openedx-platform/commi… | x_refsource_MISC |
| https://github.com/openedx/openedx-platform/commi… | x_refsource_MISC |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| openedx | openedx-platform |
Affected:
< 3a5ac856c79557c5c74d8b3e6578f289d7cceecd
|
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-53636",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-02T18:03:21.512059Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-09-02T18:03:41.926Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"references": [
{
"tags": [
"exploit"
],
"url": "https://github.com/openedx/openedx-platform/security/advisories/GHSA-6gm5-c49g-p3h9"
}
],
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "openedx-platform",
"vendor": "openedx",
"versions": [
{
"status": "affected",
"version": "\u003c 3a5ac856c79557c5c74d8b3e6578f289d7cceecd"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Open edX Platform enables the authoring and delivery of online learning at any scale. Prior to commit 3a5ac85, a security vulnerability has been identified in the Open edX LMS platform\u0027s LTI (Learning Tools Interoperability) Provider implementation. The validate_timestamp_and_nonce function in lms/djangoapps/lti_provider/signature_validator.py does not validate OAuth nonces or timestamps, allowing an attacker who captures a valid LTI launch request to replay it an unlimited number of times without detection. This issue has been patched via commit 3a5ac85."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 4.7,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "CHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-294",
"description": "CWE-294: Authentication Bypass by Capture-replay",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-02T16:54:10.403Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/openedx/openedx-platform/security/advisories/GHSA-6gm5-c49g-p3h9",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/openedx/openedx-platform/security/advisories/GHSA-6gm5-c49g-p3h9"
},
{
"name": "https://github.com/openedx/openedx-platform/commit/0a92cf25de8844bf840ffd5d18dcfd940031a2ba",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/openedx/openedx-platform/commit/0a92cf25de8844bf840ffd5d18dcfd940031a2ba"
},
{
"name": "https://github.com/openedx/openedx-platform/commit/3a5ac856c79557c5c74d8b3e6578f289d7cceecd",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/openedx/openedx-platform/commit/3a5ac856c79557c5c74d8b3e6578f289d7cceecd"
},
{
"name": "https://github.com/openedx/openedx-platform/commit/50af17b05d82a8c7e8e690cc2783a8a0ba330bc3",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/openedx/openedx-platform/commit/50af17b05d82a8c7e8e690cc2783a8a0ba330bc3"
}
],
"source": {
"advisory": "GHSA-6gm5-c49g-p3h9",
"discovery": "UNKNOWN"
},
"title": "Open edX LTI OAuth Replay Attack"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-53636",
"datePublished": "2026-09-02T16:54:10.403Z",
"dateReserved": "2026-06-09T20:16:59.647Z",
"dateUpdated": "2026-09-02T18:03:41.926Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-53635 (GCVE-0-2026-53635)
Vulnerability from cvelistv5 – Published: 2026-09-02 16:53 – Updated: 2026-09-02 18:03
VLAI
EPSS
VEX
Title
Open edX Platform: Insufficient Permission on set_course_mode_price()
Summary
Open edX Platform enables the authoring and delivery of online learning at any scale. Prior to commit 59bb6d6, the view function set_course_mode_price() at lms/djangoapps/instructor/views/instructor_dashboard.py:430 is decorated only with @login_required and performs no course-level permission check. Any authenticated user — including a learner account with zero course roles — can issue a single POST request to overwrite the honor mode price and currency of any course on the platform. The companion frontend modal was removed in a prior cleanup, but the URL route and view remain live, making this an unguarded orphan endpoint. This issue has been patched via commit 59bb6d6.
Severity
7.6 (High)
SSVC
Exploitation: poc
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-02 18:03 UTC
CWE
- CWE-862 - Missing Authorization
Assigner
References
4 references
| URL | Tags |
|---|---|
| https://github.com/openedx/openedx-platform/secur… | x_refsource_CONFIRM |
| https://github.com/openedx/openedx-platform/commi… | x_refsource_MISC |
| https://github.com/openedx/openedx-platform/commi… | x_refsource_MISC |
| https://github.com/openedx/openedx-platform/commi… | x_refsource_MISC |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| openedx | openedx-platform |
Affected:
< 59bb6d669e4fdc24d96afb809e12119372d9e257
|
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-53635",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-02T18:03:00.881308Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-09-02T18:03:26.341Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"references": [
{
"tags": [
"exploit"
],
"url": "https://github.com/openedx/openedx-platform/security/advisories/GHSA-rqq6-w4pv-7pjv"
}
],
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "openedx-platform",
"vendor": "openedx",
"versions": [
{
"status": "affected",
"version": "\u003c 59bb6d669e4fdc24d96afb809e12119372d9e257"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Open edX Platform enables the authoring and delivery of online learning at any scale. Prior to commit 59bb6d6, the view function set_course_mode_price() at lms/djangoapps/instructor/views/instructor_dashboard.py:430 is decorated only with @login_required and performs no course-level permission check. Any authenticated user \u2014 including a learner account with zero course roles \u2014 can issue a single POST request to overwrite the honor mode price and currency of any course on the platform. The companion frontend modal was removed in a prior cleanup, but the URL route and view remain live, making this an unguarded orphan endpoint. This issue has been patched via commit 59bb6d6."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "LOW",
"baseScore": 7.6,
"baseSeverity": "HIGH",
"confidentialityImpact": "LOW",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:L",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-862",
"description": "CWE-862: Missing Authorization",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-02T16:53:36.102Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/openedx/openedx-platform/security/advisories/GHSA-rqq6-w4pv-7pjv",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/openedx/openedx-platform/security/advisories/GHSA-rqq6-w4pv-7pjv"
},
{
"name": "https://github.com/openedx/openedx-platform/commit/59bb6d669e4fdc24d96afb809e12119372d9e257",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/openedx/openedx-platform/commit/59bb6d669e4fdc24d96afb809e12119372d9e257"
},
{
"name": "https://github.com/openedx/openedx-platform/commit/f25bbc4d52bd827c8f04c73de427e2e16a144c73",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/openedx/openedx-platform/commit/f25bbc4d52bd827c8f04c73de427e2e16a144c73"
},
{
"name": "https://github.com/openedx/openedx-platform/commit/fd93ef5f9940f4ad6f50cf7faecad8d9cf2d3336",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/openedx/openedx-platform/commit/fd93ef5f9940f4ad6f50cf7faecad8d9cf2d3336"
}
],
"source": {
"advisory": "GHSA-rqq6-w4pv-7pjv",
"discovery": "UNKNOWN"
},
"title": "Open edX Platform: Insufficient Permission on set_course_mode_price()"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-53635",
"datePublished": "2026-09-02T16:53:36.102Z",
"dateReserved": "2026-06-09T20:16:59.647Z",
"dateUpdated": "2026-09-02T18:03:26.341Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-42857 (GCVE-0-2026-42857)
Vulnerability from cvelistv5 – Published: 2026-05-11 17:32 – Updated: 2026-05-13 14:40
VLAI
EPSS
VEX
Title
Open edX Platform: Stored CSS Injection in Email Notifications via Incomplete HTML Sanitization
Summary
Open edX Platform enables the authoring and delivery of online learning at any scale. The HTML sanitizer clean_thread_html_body() used for discussion notification emails fails to remove <style> tags from user-generated discussion post content. This content is rendered with Django's |safe template filter in email notification templates, allowing any enrolled student to inject arbitrary CSS into email notifications sent to other users. This enables email tracking (IP address disclosure), content spoofing, and phishing attacks. This vulnerability is fixed with commit cddc25cd791bb78f76833896e4778f668861df12.
Severity
4.6 (Medium)
SSVC
Exploitation: poc
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-05-13 12:50 UTC
CWE
- CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Assigner
References
2 references
| URL | Tags |
|---|---|
| https://github.com/openedx/openedx-platform/secur… | x_refsource_CONFIRM |
| https://github.com/openedx/openedx-platform/commi… | x_refsource_MISC |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| openedx | openedx-platform |
Affected:
< cddc25cd791bb78f76833896e4778f668861df12
Affected: >= sumac, < ulmo |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-42857",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-05-13T12:50:59.990504Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-05-13T14:40:55.961Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"references": [
{
"tags": [
"exploit"
],
"url": "https://github.com/openedx/openedx-platform/security/advisories/GHSA-4xv3-5j4x-q8g4"
}
],
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "openedx-platform",
"vendor": "openedx",
"versions": [
{
"status": "affected",
"version": "\u003c cddc25cd791bb78f76833896e4778f668861df12"
},
{
"status": "affected",
"version": "\u003e= sumac, \u003c ulmo"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Open edX Platform enables the authoring and delivery of online learning at any scale. The HTML sanitizer clean_thread_html_body() used for discussion notification emails fails to remove \u003cstyle\u003e tags from user-generated discussion post content. This content is rendered with Django\u0027s |safe template filter in email notification templates, allowing any enrolled student to inject arbitrary CSS into email notifications sent to other users. This enables email tracking (IP address disclosure), content spoofing, and phishing attacks. This vulnerability is fixed with commit cddc25cd791bb78f76833896e4778f668861df12."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 4.6,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-79",
"description": "CWE-79: Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-05-11T17:32:40.940Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/openedx/openedx-platform/security/advisories/GHSA-4xv3-5j4x-q8g4",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/openedx/openedx-platform/security/advisories/GHSA-4xv3-5j4x-q8g4"
},
{
"name": "https://github.com/openedx/openedx-platform/commit/cddc25cd791bb78f76833896e4778f668861df12",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/openedx/openedx-platform/commit/cddc25cd791bb78f76833896e4778f668861df12"
}
],
"source": {
"advisory": "GHSA-4xv3-5j4x-q8g4",
"discovery": "UNKNOWN"
},
"title": "Open edX Platform: Stored CSS Injection in Email Notifications via Incomplete HTML Sanitization"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-42857",
"datePublished": "2026-05-11T17:32:40.940Z",
"dateReserved": "2026-04-30T16:44:48.379Z",
"dateUpdated": "2026-05-13T14:40:55.961Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-42858 (GCVE-0-2026-42858)
Vulnerability from cvelistv5 – Published: 2026-05-11 17:30 – Updated: 2026-05-12 16:16
VLAI
EPSS
VEX
Title
Open edX Platform: Server-Side Request Forgery (SSRF) in SAML Provider Data Sync Endpoint
Summary
Open edX Platform enables the authoring and delivery of online learning at any scale. The sync_provider_data endpoint in SAMLProviderDataViewSet allows authenticated Enterprise Admin users to supply an arbitrary URL via the metadata_url POST parameter. This URL is passed directly to requests.get() in fetch_metadata_xml() without any URL validation, IP filtering, or scheme enforcement. An attacker with Enterprise Admin privileges can force the server to make HTTP requests to internal network services, cloud metadata endpoints (e.g., AWS 169.254.169.254), or other attacker-controlled destinations. This vulnerability is fixed by commit 6fda1f120ff5a590d120ae1180185525f399c6d0 and 70a56246dd9c9df57c596e64bdd8a11b1d9da054.
Severity
8.5 (High)
SSVC
Exploitation: poc
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-05-12 16:16 UTC
CWE
- CWE-918 - Server-Side Request Forgery (SSRF)
Assigner
References
3 references
| URL | Tags |
|---|---|
| https://github.com/openedx/openedx-platform/secur… | x_refsource_CONFIRM |
| https://github.com/openedx/openedx-platform/commi… | x_refsource_MISC |
| https://github.com/openedx/openedx-platform/commi… | x_refsource_MISC |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| openedx | openedx-platform |
Affected:
< 6fda1f120ff5a590d120ae1180185525f399c6d0
|
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-42858",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-05-12T16:16:17.343622Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-05-12T16:16:54.596Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"references": [
{
"tags": [
"exploit"
],
"url": "https://github.com/openedx/openedx-platform/security/advisories/GHSA-328g-7h4g-r2m9"
}
],
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "openedx-platform",
"vendor": "openedx",
"versions": [
{
"status": "affected",
"version": "\u003c 6fda1f120ff5a590d120ae1180185525f399c6d0"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Open edX Platform enables the authoring and delivery of online learning at any scale. The sync_provider_data endpoint in SAMLProviderDataViewSet allows authenticated Enterprise Admin users to supply an arbitrary URL via the metadata_url POST parameter. This URL is passed directly to requests.get() in fetch_metadata_xml() without any URL validation, IP filtering, or scheme enforcement. An attacker with Enterprise Admin privileges can force the server to make HTTP requests to internal network services, cloud metadata endpoints (e.g., AWS 169.254.169.254), or other attacker-controlled destinations. This vulnerability is fixed by commit 6fda1f120ff5a590d120ae1180185525f399c6d0 and 70a56246dd9c9df57c596e64bdd8a11b1d9da054."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 8.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "LOW",
"privilegesRequired": "LOW",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-918",
"description": "CWE-918: Server-Side Request Forgery (SSRF)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-05-11T17:30:59.724Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/openedx/openedx-platform/security/advisories/GHSA-328g-7h4g-r2m9",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/openedx/openedx-platform/security/advisories/GHSA-328g-7h4g-r2m9"
},
{
"name": "https://github.com/openedx/openedx-platform/commit/6fda1f120ff5a590d120ae1180185525f399c6d0",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/openedx/openedx-platform/commit/6fda1f120ff5a590d120ae1180185525f399c6d0"
},
{
"name": "https://github.com/openedx/openedx-platform/commit/70a56246dd9c9df57c596e64bdd8a11b1d9da054",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/openedx/openedx-platform/commit/70a56246dd9c9df57c596e64bdd8a11b1d9da054"
}
],
"source": {
"advisory": "GHSA-328g-7h4g-r2m9",
"discovery": "UNKNOWN"
},
"title": "Open edX Platform: Server-Side Request Forgery (SSRF) in SAML Provider Data Sync Endpoint"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-42858",
"datePublished": "2026-05-11T17:30:59.724Z",
"dateReserved": "2026-04-30T16:44:48.379Z",
"dateUpdated": "2026-05-12T16:16:54.596Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-35404 (GCVE-0-2026-35404)
Vulnerability from cvelistv5 – Published: 2026-04-06 21:22 – Updated: 2026-05-11 17:29
VLAI
EPSS
VEX
Title
Open edX Platform has an Open Redirect in Survey Views via Unvalidated redirect_url Parameter
Summary
Open edX Platform enables the authoring and delivery of online learning at any scale. The view_survey endpoint accepts a redirect_url GET parameter that is passed directly to HttpResponseRedirect() without any URL validation. When a non-existent survey name is provided, the server issues an immediate HTTP 302 redirect to the attacker-controlled URL. Additionally, the same unvalidated URL is embedded in a hidden form field and returned in a JSON response after form submission, where client-side JavaScript performs location.href = url. This enables phishing and credential theft attacks against authenticated Open edX users. This vulnerability is fixed with commit 76462f1e5fa9b37d2621ad7ad19514b403908970.
Severity
4.7 (Medium)
SSVC
Exploitation: poc
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-04-07 16:17 UTC
CWE
- CWE-601 - URL Redirection to Untrusted Site ('Open Redirect')
Assigner
References
2 references
| URL | Tags |
|---|---|
| https://github.com/openedx/openedx-platform/secur… | x_refsource_CONFIRM |
| https://github.com/openedx/openedx-platform/commi… | x_refsource_MISC |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| openedx | openedx-platform |
Affected:
< 76462f1e5fa9b37d2621ad7ad19514b403908970
|
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-35404",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-04-07T16:17:36.155139Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-04-07T16:17:47.603Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "openedx-platform",
"vendor": "openedx",
"versions": [
{
"status": "affected",
"version": "\u003c 76462f1e5fa9b37d2621ad7ad19514b403908970"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Open edX Platform enables the authoring and delivery of online learning at any scale. The view_survey endpoint accepts a redirect_url GET parameter that is passed directly to HttpResponseRedirect() without any URL validation. When a non-existent survey name is provided, the server issues an immediate HTTP 302 redirect to the attacker-controlled URL. Additionally, the same unvalidated URL is embedded in a hidden form field and returned in a JSON response after form submission, where client-side JavaScript performs location.href = url. This enables phishing and credential theft attacks against authenticated Open edX users. This vulnerability is fixed with commit 76462f1e5fa9b37d2621ad7ad19514b403908970."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 4.7,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "CHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:N/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-601",
"description": "CWE-601: URL Redirection to Untrusted Site (\u0027Open Redirect\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-05-11T17:29:17.591Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/openedx/openedx-platform/security/advisories/GHSA-2843-x998-f8r2",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/openedx/openedx-platform/security/advisories/GHSA-2843-x998-f8r2"
},
{
"name": "https://github.com/openedx/openedx-platform/commit/76462f1e5fa9b37d2621ad7ad19514b403908970",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/openedx/openedx-platform/commit/76462f1e5fa9b37d2621ad7ad19514b403908970"
}
],
"source": {
"advisory": "GHSA-2843-x998-f8r2",
"discovery": "UNKNOWN"
},
"title": "Open edX Platform has an Open Redirect in Survey Views via Unvalidated redirect_url Parameter"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-35404",
"datePublished": "2026-04-06T21:22:29.562Z",
"dateReserved": "2026-04-02T17:03:42.074Z",
"dateUpdated": "2026-05-11T17:29:17.591Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-34736 (GCVE-0-2026-34736)
Vulnerability from cvelistv5 – Published: 2026-04-02 18:29 – Updated: 2026-04-03 16:08
VLAI
EPSS
VEX
Title
Open edX Platform: Account Activation Bypass via activation_key Exposure in REST API
Summary
Open edX Platform enables the authoring and delivery of online learning at any scale. From the maple release to before the ulmo release, an unauthenticated attacker can fully bypass the email verification process by combining two issues: the OAuth2 password grant issuing tokens to inactive users (documented behavior) and the activation_key being exposed in the REST API response at /api/user/v1/accounts/. This issue has been patched in the ulmo release.
Severity
5.3 (Medium)
SSVC
Exploitation: poc
Automatable: yes
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-04-03 15:48 UTC
CWE
- CWE-287 - Improper Authentication
Assigner
References
2 references
| URL | Tags |
|---|---|
| https://github.com/openedx/openedx-platform/secur… | x_refsource_CONFIRM |
| https://github.com/openedx/openedx-platform/commi… | x_refsource_MISC |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| openedx | openedx-platform |
Affected:
>= maple, < ulmo
|
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-34736",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-04-03T15:48:43.267069Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-04-03T16:08:43.532Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "openedx-platform",
"vendor": "openedx",
"versions": [
{
"status": "affected",
"version": "\u003e= maple, \u003c ulmo"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Open edX Platform enables the authoring and delivery of online learning at any scale. From the maple release to before the ulmo release, an unauthenticated attacker can fully bypass the email verification process by combining two issues: the OAuth2 password grant issuing tokens to inactive users (documented behavior) and the activation_key being exposed in the REST API response at /api/user/v1/accounts/. This issue has been patched in the ulmo release."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-287",
"description": "CWE-287: Improper Authentication",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-04-02T18:29:01.740Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/openedx/openedx-platform/security/advisories/GHSA-m6rg-rp98-4crw",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/openedx/openedx-platform/security/advisories/GHSA-m6rg-rp98-4crw"
},
{
"name": "https://github.com/openedx/openedx-platform/commit/ad342ae16e6af0b46460ca05f47697ac755feba8",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/openedx/openedx-platform/commit/ad342ae16e6af0b46460ca05f47697ac755feba8"
}
],
"source": {
"advisory": "GHSA-m6rg-rp98-4crw",
"discovery": "UNKNOWN"
},
"title": "Open edX Platform: Account Activation Bypass via activation_key Exposure in REST API"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-34736",
"datePublished": "2026-04-02T18:29:01.740Z",
"dateReserved": "2026-03-30T18:41:20.754Z",
"dateUpdated": "2026-04-03T16:08:43.532Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}