CVE-2026-53636

Katalog CVE

CVSS 4.7 · Medium EPSS 0,28%

Kerentanan Authentication Bypass by Capture-replay. Skor CVSS 3.1 4.7 (Medium) menurut github.com.

Deskripsi (NVD)

Open edX Platform enables the authoring and delivery of online learning at any scale. Prior to commit 3a5ac85, a security vulnerability has been identified in the Open edX LMS platform's LTI (Learning Tools Interoperability) Provider implementation. The validate_timestamp_and_nonce function in lms/djangoapps/lti_provider/signature_validator.py does not validate OAuth nonces or timestamps, allowing an attacker who captures a valid LTI launch request to replay it an unlimited number of times without detection. This issue has been patched via commit 3a5ac85.

Rincian

Terbit di NVD

2 September 2026

Terakhir diubah

9 September 2026

Status NVD

Deferred

CVSS 3.1

4.7 (Medium), sumber github.com
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-294: Authentication Bypass by Capture-replay

EPSS (30 hari)

0,28% peluang dieksploitasi; lebih tinggi dari 18,9% CVE lain

Produk dan versi terdampak

NVD belum mencantumkan data produk (CPE) untuk CVE ini. Produk yang terdampak biasanya disebut di deskripsi dan di advisory vendor pada daftar referensi.

Referensi dan perbaikan

• https://github.com/openedx/openedx-platform/commit/0a92cf25de8844bf840ffd5d18dcfd940031a2ba
• https://github.com/openedx/openedx-platform/commit/3a5ac856c79557c5c74d8b3e6578f289d7cceecd
• https://github.com/openedx/openedx-platform/commit/50af17b05d82a8c7e8e690cc2783a8a0ba330bc3
• https://github.com/openedx/openedx-platform/security/advisories/GHSA-6gm5-c49g-p3h9