CVE-2026-35404
MediumCVSS 4.7Exploitation Probability (EPSS)
Low risk13th percentile - higher than 13% of all known CVEs
Summary
The Open edX Platform before commit 76462f1e5fa9b37d2621ad7ad19514b403908970 contains an open redirect vulnerability in the view_survey endpoint. The redirect_url parameter is not validated, allowing attackers to redirect authenticated users to malicious sites and perform phishing and credential theft.
Risk Assessment
Attackers can abuse the trusted Open edX domain for phishing attacks and credential theft, compromising user security.
Recommendation
Immediately apply commit 76462f1e5fa9b37d2621ad7ad19514b403908970 or update the platform to a version that includes this fix.
Original NVD description (English source)
Open edX Platform enables the authoring and delivery of online learning at any scale. The view_survey endpoint accepts a redirect_url GET parameter that is passed directly to HttpResponseRedirect() without any URL validation. When a non-existent survey name is provided, the server issues an immediate HTTP 302 redirect to the attacker-controlled URL. Additionally, the same unvalidated URL is embedded in a hidden form field and returned in a JSON response after form submission, where client-side JavaScript performs location.href = url. This enables phishing and credential theft attacks against authenticated Open edX users. This vulnerability is fixed with commit 76462f1e5fa9b37d2621ad7ad19514b403908970.