CVE-2026-34736: Open edX Platform: Account Activation Bypass via activation_key Exposure in REST API
Open edX Platform enables the authoring and delivery of online learning at any scale. From the maple release to before the ulmo release, an unauthenticated attacker can fully bypass the email verification process by combining two issues: the OAuth2 password grant issuing tokens to inactive users (documented behavior) and the activationkey being exposed in the REST API response at /api/user/v1/accounts/. This issue has been patched in the ulmo release.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-34736?
CVE-2026-34736 is classified as a critical severity vulnerability due to its potential impact on account security.
How do I fix CVE-2026-34736?
To fix CVE-2026-34736, upgrade your Open edX Platform to the ulmo release or later.
What type of attack can exploit CVE-2026-34736?
CVE-2026-34736 can be exploited by unauthenticated attackers to bypass email verification during account activation.
Which versions of Open edX are affected by CVE-2026-34736?
CVE-2026-34736 affects Open edX Platform from the maple release up to but not including the ulmo release.
What impact does CVE-2026-34736 have on users?
The impact of CVE-2026-34736 allows attackers to create accounts without email verification, compromising user trust and security.