The vulnerability exists in the view_survey endpoint of Open edX, which accepts a redirect_url GET parameter and passes it directly to HttpResponseRedirect() without validation. When a requester provides a non‑existent survey name, the server immediately issues a 302 redirect to the attacker‑controlled URL. The same unvalidated redirect_url is also injected into a hidden form field and delivered in a JSON response after form submission, where client‑side JavaScript sets location.href to that URL. These behaviors let an adversary embed a malicious link that redirects authenticated users to phishing sites, enabling credential theft. The issue corresponds to CWE‑601, an open redirect weakness.

Open edX Platform (vendor openedx:openedx-platform) is affected; specific version information is not provided in the data.

The CVSS score is 4.7, indicating a moderate risk. The EPSS score of <1% indicates a very low probability of exploitation. The vulnerability is not listed in the CISA KEV catalog. Attackers can exploit this via a web request to the survey endpoint, requiring no special conditions beyond the ability to craft the redirect_url parameter, making it relatively straightforward for malicious actors targeting authenticated users.