CVE-2026-34736: falha de média gravidade em openedx-platform
Open edX Platform: Account Activation Bypass via activation_key Exposure in REST API
Publicada em · Atualizada em
Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.
13Vexday Risk Score
Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.
ssvc Trackcvss 5.3epss 0.2%
Open edX Platform enables the authoring and delivery of online learning at any scale. From the maple release to before the ulmo release, an unauthenticated attacker can fully bypass the email verification process by combining two issues: the OAuth2 password grant issuing tokens to inactive users (documented behavior) and the activation_key being exposed in the REST API response at /api/user/v1/accounts/. This issue has been patched in the ulmo release.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
Produtos afetados
openedx · openedx-platformCVEs relacionadas — openedx-platform
No mesmo produto, das mais perigosas para as menos.
CVE-2026-85272MEDIUMOpen edX Platform: Path traversal via prefix-bypass in safe_extractall Path ValidationEPSS 0.5%CVE-2026-55421MEDIUMOpen edX Platform: SSRF in Studio Video Download EndpointEPSS 0.5%CVE-2026-53635HIGHOpen edX Platform: Insufficient Permission on set_course_mode_price()EPSS 0.4%CVE-2026-42858HIGHOpen edX Platform: Server-Side Request Forgery (SSRF) in SAML Provider Data Sync EndpointEPSS 0.4%CVE-2026-85271MEDIUMOpen edX Platform: Stored CSS Injection in Email Digest Notifications via Unsanitized Thread Title (incomplete patch of CVE-2026-42857)EPSS 0.4%CVE-2026-53636MEDIUMOpen edX LTI OAuth Replay AttackEPSS 0.3%