Open edX Platform Activation Bypass Vulnerability via Activation Key Exposure in REST API

A vulnerability in the Open edX Platform allows an unauthenticated attacker to bypass the email verification process. This issue arises from the OAuth2 password grant issuing tokens to inactive users, combined with the activation key being exposed in the REST API response at '/api/user/v1/accounts/'. The vulnerability is present in Open edX versions from the maple release to prior to the ulmo release.

Impact

Exploitation of this vulnerability allows for unauthorized account activation, bypassing the email verification process.

Reproduction

To reproduce this vulnerability, an attacker can register a new account and receive an OAuth2 token, despite the account being inactive. The activation key, which is normally a secret used for email verification, is exposed in the API response. The attacker can then use this key to activate the account via the '/activate/{key}' endpoint, without accessing the email.

Remediation

This vulnerability has been patched in the Open edX ulmo release. Users should update to this version.