PT-2026-30739 · Edx · Open Edx Platform

Ik0Z · Published 2026-04-06 · Updated 2026-04-06 · CVE-2026-35404

Positive Technologies · (AI Summary)

CVSS v3.1

4.7

Medium

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions Open edX Platform (affected versions not specified)

Description The Open edX Platform allows for the creation and delivery of online learning content. The view survey API endpoint is susceptible to an open redirect issue due to the lack of validation for the redirect url GET parameter. Providing a non-existent survey name results in an unvalidated HTTP 302 redirect to a user-controlled URL. This same unvalidated URL is also included in a hidden form field and returned in a JSON response, where client-side JavaScript then redirects the user to that URL. This can lead to phishing and credential theft attacks against authenticated users.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Open Redirect

Weakness Enumeration

CWE-601

Related Identifiers

CVE-2026-35404

Affected Products

Open Edx Platform

References · 5

• https://nvd.nist.gov/vuln/detail/CVE-2026-35404 · Security Note
• https://github.com/openedx/openedx-platform/commit/76462f1e5fa9b37d2621ad7ad19514b403908970 · Note
• https://github.com/openedx/openedx-platform/security/advisories/GHSA-2843-x998-f8r2 · Note
• https://twitter.com/infoflowcloud/status/2041283807152595269 · Twitter Post
• https://twitter.com/CVEnew/status/2041282880585052211 · Twitter Post