CVE-2026-35404

CVE-2026-35404 is an open redirect vulnerability in the Open edX Platform's view_survey endpoint that fails to validate the redirect_url parameter before passing it to HttpResponseRedirect(). The vulnerability affects the Open edX learning platform and enables attackers to redirect authenticated users to arbitrary external URLs, facilitating phishing and credential theft attacks. The vulnerability presents a medium severity risk with a CVSS score of 6.1. It requires no authentication or special access conditions (network-accessible endpoint), has low attack complexity, and relies on user interaction to exploit. The attack can result in limited information disclosure and integrity impact through credential compromise, though system availability is not affected. There is currently no evidence of active exploitation in the wild. The vulnerability is not listed on CISA's Known Exploited Vulnerabilities catalog, nor is it designated as a high-priority Hot List item. The extremely low EPSS score of 0.0003 indicates minimal current threat activity. The issue was addressed in commit 76462f1e5fa9b37d2621ad7ad19514b403908970, and organizations using Open edX should apply this patch to remediate the risk.