CVE-2026-41588 - Vulnerability Analysis
CriticalCVSS: 9.0Last Updated: May 8, 2026
RELATE - Timing Attack
Published: May 8, 2026Updated: May 8, 2026Remote Exploitable
Overview
RELATE contains a timing attack vulnerability caused by insecure implementation in course/auth.py check_sign_in_key(), letting attackers infer sensitive information via timing differences, exploit requires crafted requests.
Severity & Score
Severity: Critical
CVSS Score: 9.0
Impact
Attackers can infer sensitive authentication information, potentially leading to unauthorized access.
Mitigation
Update to the version including commit 2f68e16 or later.
References
Related Resources
Details
- CVE ID
- CVE-2026-41588
- Severity
- Critical
- CVSS Score
- 9.0
- Type
- timing_attack
- Status
- unconfirmed
CWE
- CWE-208
CVSS Metrics
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H