CVE-2026-41505 - Vulnerability Analysis
HighCVSS: 8.7Last Updated: May 7, 2026
RELATE - Authentication Bypass
Published: May 7, 2026Updated: May 7, 2026Remote Exploitable
Overview
RELATE contains a predictable token generation vulnerability caused by weak randomness in auth.py's make_sign_in_key() and exam.py's gen_ticket_code() functions, letting attackers predict authentication tokens, exploit requires no special privileges.
Severity & Score
Severity: High
CVSS Score: 8.7
Impact
Attackers can predict authentication tokens, potentially allowing unauthorized access or impersonation.
Mitigation
Update to the version including commit 2f68e16 or later.
References
Related Resources
Details
- CVE ID
- CVE-2026-41505
- Severity
- High
- CVSS Score
- 8.7
- Type
- broken_authentication
- Status
- unconfirmed
CWE
- CWE-330
CVSS Metrics
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:N/I:H/A:H