CVE-2026-34736

MediumCVSS 5.3/10Last modified Jul 24, 2026

Description

Open edX Platform enables the authoring and delivery of online learning at any scale. From the maple release to before the ulmo release, an unauthenticated attacker can fully bypass the email verification process by combining two issues: the OAuth2 password grant issuing tokens to inactive users (documented behavior) and the activation_key being exposed in the REST API response at /api/user/v1/accounts/. This issue has been patched in the ulmo release.

Metrics

CVSS 3.1 5.3/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

Weakness enumeration

CWE-287

Affected software

Source: the vendor's advisory (CNA). NVD analysis pending.

Vendor	Product	Versions
openedx	openedx-platform	>= maple, < ulmo

References

Timeline

Published: Apr 2, 2026
Last modified: Jul 24, 2026
NVD status: Awaiting Analysis

Related CVEs from 2026

CVE-2026-347376.5WWBN AVideo is an open source video platform. In versions 26.0 and prior, the StripeYPT plugin includes a test.php debug endpoint that is ac CVE-2026-347384.3WWBN AVideo is an open source video platform. In versions 26.0 and prior, AVideo's video processing pipeline accepts an overrideStatus reque CVE-2026-347396.1WWBN AVideo is an open source video platform. In versions 26.0 and prior, the User_Location plugin's testIP.php page reflects the ip request CVE-2026-34744.9The EmailKit – Email Customizer for WooCommerce & WP plugin for WordPress is vulnerable to arbitrary file read via path traversal in all ver CVE-2026-347406.5WWBN AVideo is an open source video platform. In versions 26.0 and prior, the EPG (Electronic Program Guide) link feature in AVideo allows a CVE-2026-347418.6Combodo iTop is a web based IT service management tool. Prior to 3.2.3, authentication bypass allows unauthenticated remote attackers to exe CVE-2026-347428.1The Go MCP SDK used Go's standard encoding/json. Prior to version 1.4.0, the Model Context Protocol (MCP) Go SDK does not enable DNS rebindi CVE-2026-347435.3XZ Utils provide a general-purpose data-compression library plus command-line tools. Prior to version 5.8.3, if lzma_index_decoder() was use CVE-2026-347445.3Mantis Bug Tracker (MantisBT) is an open source issue tracker. Versions 2.28.1 and prior permit a user to list and download their own attach CVE-2026-347459.1Fireshare facilitates self-hosted media and link sharing. Prior to version 1.5.3, the fix for CVE-2026-33645 was applied to the authenticate CVE-2026-347467.7Payload is a free and open source headless content management system. Prior to version 3.79.1, an authenticated Server-Side Request Forgery CVE-2026-347478.2Payload is a free and open source headless content management system. Prior to version 3.79.1, certain request inputs were not properly vali