PT-2026-21958 · Unknown · Openfun Richie

Ordogh + 1 · Published 2026-02-25 · Updated 2026-02-28 · CVE-2026-26717

Positive Technologies (AI Summary)

CVSS v3.1

4.8

Medium

Base vector

AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions OpenFUN Richie (LMS) (affected versions not specified)

Description The application uses a non-constant time comparison operator for HMAC signature verification within the sync course run from request function, located in src/richie/apps/courses/api.py. This allows attackers to potentially forge valid signatures and bypass authentication by observing response time differences. The vulnerable comparison is performed using the == operator. The API endpoint involved is not explicitly mentioned, but the issue resides within the course run synchronization functionality. The vulnerable parameter is the HMAC signature used for authentication.

Recommendations Replace the non-constant time comparison operator with a constant-time comparison function in the sync course run from request function.

Exploit

Fix

Weakness Enumeration

CWE-208

Related Identifiers

CVE-2026-26717

GHSA-XJHR-FM27-4HMX

Affected Products

Openfun Richie

References · 9

• 🔥 https://github.com/Rickidevs/CVE-2026-26717 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2026-26717 · Security Note
• https://osv.dev/vulnerability/CVE-2026-26717 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-xjhr-fm27-4hmx · Vendor Advisory
• https://github.com/openfun/richie/commit/a1b5bbda3403d7debb466c303a32852925fcba5f · Note
• https://github.com/openfun/richie · Note
• https://twitter.com/CVEnew/status/2027744295327871005 · Twitter Post
• https://medium.com/@ordogh/cve-2026-26717-hmac-timing-attack-in-openfun-richie-lms-f04377efe83d?postPublishedType=repub · Note
• https://twitter.com/infoflowcloud/status/2027744674841039122 · Twitter Post