CVE-2026-35404 Open edX Platform has an Open Redirect in Survey Views via Unvalidated redirect_url Parameter
Attackers can redirect authenticated Open edX users to malicious sites via unvalidated parameters, enabling phishing and credential theft.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- None listed
What is CVE-2026-35404?
CVE-2026-35404 is a medium-severity vulnerability in openedx-platform, published on 6 Apr 2026. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
Open edX Platform enables the authoring and delivery of online learning at any scale. The view_survey endpoint accepts a redirect_url GET parameter that is passed directly to HttpResponseRedirect() without any URL validation. When a non-existent survey name is provided, the server issues an immediate HTTP 302 redirect to the attacker-controlled URL. Additionally, the same unvalidated URL is embedded in a hidden form field and returned in a JSON response after form submission, where client-side JavaScript performs location.href = url. This enables phishing and credential theft attacks against authenticated Open edX users. This vulnerability is fixed with commit 76462f1e5fa9b37d2621ad7ad19514b403908970.
Weakness: CWE-601
Which versions are affected by CVE-2026-35404?
It affects 1 product.
Products include Openedx Openedx.
How do I fix CVE-2026-35404?
No fix has been published for CVE-2026-35404 yet. Limit exposure of the affected software until one is available.
Is CVE-2026-35404 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-35404 exists.
Other vulnerabilities in openedx-platform
- CVE-2026-42858 Open edX Platform: Server-Side Request Forgery (SSRF) in SAML Provider Data Sync Endpoint
- CVE-2024-43782 openedx-translations's Atlas translations for Open edX missing validation
- CVE-2026-42857 Open edX Platform: Stored CSS Injection in Email Notifications via Incomplete HTML Sanitization
Sources
Also known as GHSA-2843-x998-f8r2.