Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
5.3
CVE-2026-34736: Open edX Platform: Account Activation Bypass via activation_key Exposure in REST API
CVE-2026-34736 · published 7 months ago
Summary
Open edX Platform enables the authoring and delivery of online learning at any scale. From the maple release to before the ulmo release, an unauthenticated attacker can fully bypass the email verification process by combining two issues: the OAuth2 password grant issuing tokens to inactive users (do...
Original advisory text
Open edX Platform: Account Activation Bypass via activation_key Exposure in REST API
Open edX Platform enables the authoring and delivery of online learning at any scale. From the maple release to before the ulmo release, an unauthenticated attacker can fully bypass the email verification process by combining two issues: the OAuth2 password grant issuing tokens to inactive users (documented behavior) and the activation_key being exposed in the REST API response at /api/user/v1/accounts/. This issue has been patched in the ulmo release.
References
- https://github.com/openedx/openedx-platform/security/advisories/GHSA-m6rg-rp98-4... Vendor Advisory
- https://github.com/openedx/openedx-platform/commit/ad342ae16e6af0b46460ca05f4769... Patch
- https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/34xxx/CVE-2026-34736... Vendor Advisory
- https://nvd.nist.gov/vuln/detail/CVE-2026-34736 Vendor Advisory
Internet-facing
14 days
Internal
60 days
- Not known to be exploited
- Can be exploited automatically
- Gives an attacker partial control
Type
CWE-287Improper Authentication
Timeline
Published2 Apr 2026
Updated30 Oct 2026
First seen29 Sep 2026
Track software like this
Free during beta