Open edX Platform: Account Activation Bypass via activation_key Exposure in REST API

Successful exploitation of CVE-2026-34736 allows an attacker to bypass the email verification process in Open edX. This means an attacker could potentially create and access user accounts without needing to verify the associated email address. The impact extends to the compromise of user accounts, potentially leading to unauthorized access to learning materials, course data, and personal information stored within the platform. While the vulnerability requires combining two factors (inactive user and exposed API key), the potential for widespread account takeover is significant, particularly in environments with a large number of inactive users.

Educational institutions and organizations utilizing Open edX Platform for online learning are at risk. Specifically, deployments using the maple release and those with a significant number of inactive user accounts are particularly vulnerable. Shared hosting environments running Open edX may also be at increased risk due to potential limitations in access control and monitoring.

• python / server:

import requests

url = "https://your-openedx-instance/api/user/v1/accounts/"

try:
    response = requests.get(url)
    if response.status_code == 200:
        print("Activation key potentially exposed in response:", response.json())
    else:
        print("Endpoint returned status code:", response.status_code)
except requests.exceptions.RequestException as e:
    print("Error connecting to endpoint:", e)

• linux / server:

journalctl -u openedx -f | grep "activation_key"

• generic web: Use a web proxy or browser extension to inspect the response from /api/user/v1/accounts/ for the presence of an activation_key field in the JSON response.

1. 2026-04-02Disclosure

   disclosure

1. Reserviert2026-03-30
2. Veröffentlicht2026-04-02
3. Geändert2026-04-03
4. EPSS aktualisiert2026-04-10

The primary mitigation for CVE-2026-34736 is to upgrade Open edX Platform to version ulmo or later, which contains the fix. If immediate upgrading is not possible, consider implementing temporary workarounds. Restricting access to the /api/user/v1/accounts/ endpoint to authenticated users only can help prevent the exposure of activation keys. Additionally, review OAuth2 configurations to ensure that tokens are not being issued to inactive users. Monitor API logs for suspicious activity related to account creation and activation.