CVE-2026-41505 Details
Description
RELATE is a web-based courseware package. Prior to commit 2f68e16, RELATE is vulnerable to predictable token generation in auth.py's make_sign_in_key() function and exam.py's gen_ticket_code() function. This issue has been patched via commit 2f68e16.
A vulnerability exists in the RELATE web-based courseware package, specifically in versions through 2024.1. The issue arises from predictable token generation in the 'make_sign_in_key' function within 'auth.py' and the 'gen_ticket_code' function in 'exam.py'. This vulnerability is rooted in the use of a non-cryptographic pseudorandom number generator (PRNG) for generating security-sensitive tokens, which could be exploited to predict future token values.
The vulnerability has been patched in the RELATE courseware package. Users should update to the version that includes the commit 2f68e16cd3b96d25c188c1aa3f7e13cdb15cdaeb, which replaces the use of the non-cryptographic PRNG with 'secrets', a module designed for generating cryptographically secure tokens.
Metrics
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed May 7, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-330 | Use of Insufficiently Random Values | [email protected] |
| CWE-338 | Use of Cryptographically Weak Pseudo-Random Number Generator (PRNG) | [email protected] |
Affected Products
No affected product data is available for this CVE.
Change History
3 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| May 7, 2026 | New CVE Received | [email protected] |