Open edX Platform Vulnerability in URL Redirection Logic

CVE-2026-35404

What is CVE-2026-35404?

The Open edX Platform contains a vulnerability that allows for unvalidated URL redirection via the view_survey endpoint. An attacker can exploit this issue by providing a non-existent survey name, resulting in the server redirecting to a malicious URL. This compromised URL can be used to carry out phishing and credential theft attacks against authenticated users of the platform. Additionally, the unvalidated URL is unknowingly embedded within a hidden form field and returned in a JSON response, exacerbating the risk through client-side JavaScript execution. A fix has been implemented in a recent commit.

References