PT-2026-38443 · Inducer · Relate

Published 2026-05-07 · Updated 2026-05-07 · CVE-2026-41505

NVD

CVSS v3.1

8.7

High

Base vector

AV:N/AC:H/PR:N/UI:N/S:C/C:N/I:H/A:H

RELATE is a web-based courseware package. Prior to commit 2f68e16, RELATE is vulnerable to predictable token generation in auth.py's make sign in key() function and exam.py's gen ticket code() function. This issue has been patched via commit 2f68e16.

Fix

Use of Insufficiently Random Values

Weakness Enumeration

CWE-330

CWE-338

Related Identifiers

CVE-2026-41505

Affected Products

Relate

References · 3

• https://nvd.nist.gov/vuln/detail/CVE-2026-41505 · Security Note
• https://github.com/inducer/relate/commit/2f68e16cd3b96d25c188c1aa3f7e13cdb15cdaeb · Note
• https://github.com/inducer/relate/security/advisories/GHSA-rvx5-95mm-p77v · Note