CVE-2026-41588 Details
Description
RELATE is a web-based courseware package. Prior to commit 2f68e16, there is a timing attack vulnerability in course/auth.py — check_sign_in_key(). This issue has been patched via commit 2f68e16.
A timing attack vulnerability has been identified in the RELATE web-based courseware package, specifically in the authentication method used for sign-in tokens. This vulnerability is present in versions of the courseware through 2024.1. The issue arises because the equality operator in Python compares strings in a way that can be exploited to leak valid tokens one byte at a time by measuring response times. The vulnerable code is located in the 'check_sign_in_key' function of 'course/auth.py', as well as in 'EmailedTokenBackend.authenticate()'.
The vulnerability has been patched in the RELATE courseware package. Users should update to the version that includes the commit 2f68e16.
Metrics
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed May 8, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-203 | Observable Discrepancy | [email protected] |
| CWE-208 | Observable Timing Discrepancy | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| inducer relate | < 2026-04-17 |
CPE
Remediation
| |
Change History
4 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| May 12, 2026 | Initial Analysis | [email protected] |
| May 8, 2026 | New CVE Received | [email protected] |