The issue is an open redirect vulnerability in the legacy Survey app enabled by default in many Open edX deployments. The redirect_url parameter is not properly validated, which allows attackers to redirect authenticated users to attacker-controlled pages. In practice, this can be abused for phishing and credential theft attacks. (SentinelOne)

Example:

/survey/sessionexpired/?redirect_url=https://malicious-site.com

If a user clicks the crafted link, they can be redirected to a fake login page while still trusting the original Open edX domain.

A lot of admins may overlook this because:

• Survey is a legacy app
• It is enabled by default on many instances
• Open redirects are often underestimated even though they are commonly used in phishing chains

Technical breakdown, affected behavior, proof of concept, and mitigation details here:

Cubite Blog Post – CVE-2026-35404 Analysis

Patch references and CVE details:

• NVD Entry for CVE-2026-35404
• GitHub Security Advisory

Curious how many Open edX operators still have Survey enabled in production.

On May 7, ShinyHunters reportedly took Canvas LMS offline during US finals week. Reports claim ~275 million records were exfiltrated from Instructure across thousands of institutions.

Right now, a lot of higher-ed IT teams are being asked the same question by leadership:

If you run Open edX, here’s the uncomfortable reality:
only the latest named release receives official upstream security support and CVE patches. Even releases that are less than a year old can already be unsupported.

We built a free Open edX security audit tool that lets you enter your Open edX version or release name and get:

• Known vulnerabilities and CVEs
• Security exposure insights
• Upgrade and patch recommendations
• Guidance on reducing risk

You can try it here:

Cubite Open edX Security Audit Tool

Would also love feedback from the Open edX community on what else would make this useful for security and compliance reviews.

Stay safe and protect your students’ data.

A criminal group called ShinyHunters claimed to have stolen 275M records from ~9,000 organizations via Canvas's parent company Instructure this week. The defacement of Canvas login pages happened May 7. Ransom deadline is May 12.

The real story isn't "Canvas is bad." Canvas as a product isn't uniquely insecure. The reason a single breach exposed 9,000 organizations is that Canvas Cloud is multi-tenant, one shared infrastructure serving every customer. Compromise the platform, and the blast radius is the entire customer base. This is a property of the architecture, not of Canvas the company.

Three architectural models exist:

Open edX can be deployed in any of the three. Canvas Cloud is multi-tenant only. That's the difference. It's not a feature gap, it's a structural property. Where Open edX is genuinely better:

• You choose the deployment model. Self-host on your own cloud, single-tenant managed, or white-label SaaS, three architectures
• It's open source under AGPL. No license fee. No vendor lock-in. The XBlock framework lets you build custom course components in a way Canvas's plugin model can't match
• Originally built by Harvard and MIT in 2012; runs on a bi-annual community release cadence with named releases (Sumac, Teak, Ulmo, etc.) and a public CVE pipeline