# CVE-2026-35404: Open edX Platform open redirect in survey views

Source: https://junglewise.ai/threats/cve-2026-35404-open-edx-platform-open-redirect-in-survey-views  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-04-06. Updated: 2026-07-24  
License: CC BY 4.0 with a link back

CVE-2026-35404 · Severity: medium · CVSS 4.7 · Published 2026-04-06

The Open edX Platform, a popular online learning system, contains a security flaw in its survey component. An attacker can create a specially crafted link that appears to be a legitimate part of the educational site but instead redirects logged-in students or staff to a malicious external website. This can be used in phishing campaigns to trick users into providing their login credentials or other sensitive information on a fake site that looks like the real platform.

Technologies: [Open edX Platform](https://junglewise.ai/threats/technologies/open-edx-platform). Vendors: [Open edX](https://junglewise.ai/threats/vendors/open-edx).

## Quick answers

**Is CVE-2026-35404 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-35404 being exploited in the wild.

**How severe is CVE-2026-35404?** Medium severity, with a CVSS score of 4.7, published 6 April 2026.

**Which products and versions are affected?** Open edX Platform <= master (all versions containing the survey app), All versions containing the survey app up to 2026-04-02.

**Is there a fix for CVE-2026-35404?** A patch was published on 2026-04-02: Fix committed to master branch Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-35404 attacked?** It is attacked over the network, in a network appliance.

**Am I affected by CVE-2026-35404?** Check whether you run Open edX Platform or Openedx at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

An open redirect vulnerability exists in the Open edX Platform's survey application. The 'view_survey' endpoint in 'lms/djangoapps/survey/views.py' accepts a 'redirect_url' GET parameter and passes it directly to 'HttpResponseRedirect()' without validation when a non-existent survey name is requested. Additionally, for valid surveys, the same unvalidated URL is stored in a hidden form field and subsequently used by client-side JavaScript ('location.href') after form submission. An attacker can exploit this by distributing a crafted URL to authenticated users. The vulnerability is fixed by ignoring user-supplied redirect URLs in the survey views and defaulting redirects to the user dashboard.

## Affected products

- openedx Open edX Platform <= master (all versions containing the survey app)

## Timeline

- 2026-04-02: advisory: Original GHSA advisory published
- 2026-04-06: disclosed: CVE-2026-35404 published
- 2026-04-02: patched: Fix committed to master branch

## References

- [https://github.com/openedx/openedx-platform/commit/76462f1e5fa9b37d2621ad7ad19514b403908970](https://github.com/openedx/openedx-platform/commit/76462f1e5fa9b37d2621ad7ad19514b403908970)
- [https://github.com/openedx/openedx-platform/security/advisories/GHSA-2843-x998-f8r2](https://github.com/openedx/openedx-platform/security/advisories/GHSA-2843-x998-f8r2)

## Related threats

- [Open edX Platform authorization bypass in course team API](https://junglewise.ai/threats/cve-2026-97702-open-edx-platform-enables-the-authoring-and-delivery-of-online)
- [Open edX Platform path traversal in archive extraction](https://junglewise.ai/threats/cve-2026-85272-open-edx-platform-enables-the-authoring-and-delivery-of-online)
- [Open edX Platform SSRF in video download endpoint](https://junglewise.ai/threats/cve-2026-55421-open-edx-platform-ssrf-in-video-download-endpoint)
- [Open edX Platform LTI replay attack in nonce validation](https://junglewise.ai/threats/cve-2026-53636-open-edx-platform-lti-replay-attack-in-nonce-validation)
- [Open edX Platform privilege escalation in course price setting](https://junglewise.ai/threats/cve-2026-53635-open-edx-platform-privilege-escalation-in-course-price-setting)