CVE-2026-35404: Open edX Platform has an Open Redirect in Survey Views via Unvalidated redirect_url Parameter
Open edX Platform enables the authoring and delivery of online learning at any scale. The viewsurvey endpoint accepts a redirecturl GET parameter that is passed directly to HttpResponseRedirect() without any URL validation. When a non-existent survey name is provided, the server issues an immediate HTTP 302 redirect to the attacker-controlled URL. Additionally, the same unvalidated URL is embedded in a hidden form field and returned in a JSON response after form submission, where client-side JavaScript performs location.href = url. This enables phishing and credential theft attacks against authenticated Open edX users. This vulnerability is fixed with commit 76462f1e5fa9b37d2621ad7ad19514b403908970.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Open edX Platformto a version that resolves this vulnerability.Patch 76462f1e5fa9b37d2621ad7ad19514b403908970
Event History
Frequently Asked Questions
What is the severity of CVE-2026-35404?
CVE-2026-35404 is classified as a medium severity vulnerability due to the potential for unauthorized redirects.
How do I fix CVE-2026-35404?
To mitigate CVE-2026-35404, ensure that the redirect_url parameter is validated and sanitize any input before use.
What kind of attacks can CVE-2026-35404 facilitate?
CVE-2026-35404 can facilitate open redirection attacks, which may lead to phishing or other malicious activities.
Which versions of Open edX are affected by CVE-2026-35404?
Open edX versions up to and including 2026-04-02 are affected by CVE-2026-35404.
Is CVE-2026-35404 a widespread vulnerability?
CVE-2026-35404 affects the Open edX Platform, which is used for online learning, making it potentially significant for its user base.