Openedx Openedx-Platform vulnerabilities

CVE-2026-42858 [CRITICAL] CWE-918 CVE-2026-42858: Open edX Platform enables the authoring and delivery of online learning at any scale. The sync_provi Open edX Platform enables the authoring and delivery of online learning at any scale. The sync_provider_data endpoint in SAMLProviderDataViewSet allows authenticated Enterprise Admin users to supply an arbitrary URL via the metadata_url POST parameter. This URL is passed directly to requests.get() in fetch_metadata_xml() without any URL validation

CVE-2026-34736 [MEDIUM] CWE-287 CVE-2026-34736: Open edX Platform enables the authoring and delivery of online learning at any scale. From the maple Open edX Platform enables the authoring and delivery of online learning at any scale. From the maple release to before the ulmo release, an unauthenticated attacker can fully bypass the email verification process by combining two issues: the OAuth2 password grant issuing tokens to inactive users (documented behavior) and the activation_key being exp

CVE-2026-35404 [MEDIUM] CWE-601 CVE-2026-35404: Open edX Platform enables the authoring and delivery of online learning at any scale. The view_surve Open edX Platform enables the authoring and delivery of online learning at any scale. The view_survey endpoint accepts a redirect_url GET parameter that is passed directly to HttpResponseRedirect() without any URL validation. When a non-existent survey name is provided, the server issues an immediate HTTP 302 redirect to the attacker-controlled URL.

CVE-2026-42857 [MEDIUM] CWE-79 CVE-2026-42857: Open edX Platform enables the authoring and delivery of online learning at any scale. The HTML sanit Open edX Platform enables the authoring and delivery of online learning at any scale. The HTML sanitizer clean_thread_html_body() used for discussion notification emails fails to remove tags from user-generated discussion post content. This content is rendered with Django's |safe template filter in email notification templates, allowing any enrolled