CVE-2026-35404 Details

A server-side open redirect vulnerability has been identified in the Open edX Platform within the survey feature. The issue arises in the 'view_survey' endpoint, which accepts a 'redirect_url' GET parameter. This parameter is passed directly to 'HttpResponseRedirect()' without any validation. When a non-existent survey name is requested, the server immediately redirects to the attacker-controlled URL. Additionally, if a valid survey is requested, the same unvalidated URL is embedded in a hidden form field and returned in a JSON response after the form is submitted. Client-side JavaScript then uses this URL for redirection. This vulnerability enables phishing attacks and credential theft against authenticated Open edX users.

Users can update to the patched version of Open edX Platform, where this vulnerability has been addressed by removing the 'redirect_url' parameter from the 'view_survey' endpoint and ensuring that the 'submit_answers' endpoint always redirects to the dashboard.