CVE-2026-26717 - Vulnerability Analysis

Overview

OpenFUN Richie (LMS) contains an authentication bypass caused by non-constant time HMAC signature verification in sync_course_run_from_request, letting remote attackers forge valid signatures, exploit requires network access.

Severity & Score

Impact

Remote attackers can bypass authentication by forging valid signatures, potentially gaining unauthorized access.

Mitigation

Update to the latest version with constant time HMAC verification.

References

• https://github.com/Rickidevs/CVE-2026-26717
• https://github.com/openfun/richie/commit/a1b5bbda3403d7debb466c303a32852925fcba5f
• https://medium.com/@ordogh/cve-2026-26717-hmac-timing-attack-in-openfun-richie-lms-f04377efe83d?postPublishedType=repub

Related Resources

• Vulnerability Intelligence Dashboard
• Credential Scanner