PT-2026-21958 · Unknown · Openfun Richie

Ordogh + 1 · Publicado 2026-02-25 · Atualizado 2026-02-28 · CVE-2026-26717

Positive Technologies (AI Summary)

CVSS v3.1

4.8

Média

Vetor base

AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions OpenFUN Richie (LMS) (affected versions not specified)

Description The application uses a non-constant time comparison operator for HMAC signature verification within the sync course run from request function, located in src/richie/apps/courses/api.py. This allows attackers to potentially forge valid signatures and bypass authentication by observing response time differences. The vulnerable comparison is performed using the == operator. The API endpoint involved is not explicitly mentioned, but the issue resides within the course run synchronization functionality. The vulnerable parameter is the HMAC signature used for authentication.

Recommendations Replace the non-constant time comparison operator with a constant-time comparison function in the sync course run from request function.

Exploit

Correção

Enumeração de Fraquezas

CWE-208

Identificadores relacionados

CVE-2026-26717

GHSA-XJHR-FM27-4HMX

Produtos afetados

Openfun Richie

Referências · 9

• 🔥 https://github.com/Rickidevs/CVE-2026-26717 · Exploit
• https://github.com/openfun/richie/commit/a1b5bbda3403d7debb466c303a32852925fcba5f · Nota
• https://github.com/openfun/richie · Nota
• https://twitter.com/CVEnew/status/2027744295327871005 · Publicação no Twitter
• https://nvd.nist.gov/vuln/detail/CVE-2026-26717 · Nota de Segurança
• https://osv.dev/vulnerability/CVE-2026-26717 · Aviso do Fabricante
• https://osv.dev/vulnerability/GHSA-xjhr-fm27-4hmx · Aviso do Fabricante
• https://medium.com/@ordogh/cve-2026-26717-hmac-timing-attack-in-openfun-richie-lms-f04377efe83d?postPublishedType=repub · Nota
• https://twitter.com/infoflowcloud/status/2027744674841039122 · Publicação no Twitter