The vulnerability allows an unauthenticated attacker to bypass the email verification process in Open edX Platform. By exploiting the fact that OAuth2 password grants are issued to inactive users and that the activation_key is exposed in the /api/user/v1/accounts/ REST API response, the attacker can obtain a valid activation key and create a session for the account without confirming the user’s email. This results in unauthorized activation of a user account, potentially granting the attacker access to course content, instructor privileges, or administrative functions, depending on the account role.

The issue affects the Open edX Platform (openedx:openedx-platform). It exists in all releases from the maple version through and including releases prior to ulmo. The ulmo release contains the patch.

The CVSS score of 5.3 indicates moderate severity. Because no authentication is required and the exploit relies solely on reading a public API and constructing an OAuth2 token, the attack vector is likely remote and trivial to employ for an attacker with internet access. EPSS is currently unknown and the vulnerability is not listed in the CISA KEV catalog, but the combination of credential exposure and authentication bypass still warrants prompt remediation.