PT-2026-29871 · Unknown · Open Edx Platform

Dabaes · Published 2026-04-02 · Updated 2026-04-03 · CVE-2026-34736

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

Name of the Vulnerable Software and Affected Versions Open edX Platform versions maple through ulmo (exclusive)

Description The Open edX Platform allows for the creation and delivery of online learning experiences. An unauthenticated attacker can bypass the email verification process between the maple release and before the ulmo release. This is achieved by combining the OAuth2 password grant issuing tokens to inactive users and the exposure of the activation key in the REST API response at /api/user/v1/accounts/.

Recommendations Upgrade to the ulmo release or later.

Fix

Improper Authentication

Weakness Enumeration

CWE-287

Related Identifiers

CVE-2026-34736

Affected Products

Open Edx Platform

References · 5

• https://nvd.nist.gov/vuln/detail/CVE-2026-34736 · Security Note
• https://github.com/openedx/openedx-platform/commit/ad342ae16e6af0b46460ca05f47697ac755feba8 · Note
• https://github.com/openedx/openedx-platform/security/advisories/GHSA-m6rg-rp98-4crw · Note
• https://twitter.com/VulmonFeeds/status/2039923132400599354 · Twitter Post
• https://twitter.com/CVEnew/status/2040128788667785440 · Twitter Post