CVE-2026-34736: Open edX Platform: Account Activation Bypass via activation_key Exposure in REST API

Severity: medium (CVSS 5.3 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.2% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2026-04-02 · updated 2026-07-24
Weakness: CWE-287

Description

Open edX Platform enables the authoring and delivery of online learning at any scale. From the maple release to before the ulmo release, an unauthenticated attacker can fully bypass the email verification process by combining two issues: the OAuth2 password grant issuing tokens to inactive users (documented behavior) and the activation_key being exposed in the REST API response at /api/user/v1/accounts/. This issue has been patched in the ulmo release.

Affected products

openedx-platform: >= maple, < ulmo

References

https://github.com/openedx/openedx-platform/commit/ad342ae16e6af0b46460ca05f47697ac755feba8
https://github.com/openedx/openedx-platform/security/advisories/GHSA-m6rg-rp98-4crw

Get alerted when CVE-2026-34736 or the next vulnerability affects your stack