CVE-2026-41588 - Vulnerability Details - OpenCVE

RELATE is a web-based courseware package. Prior to commit 2f68e16, there is a timing attack vulnerability in course/auth.py — check_sign_in_key(). This issue has been patched via commit 2f68e16.

No CVSS v4.0

Attack Vector Network

Attack Complexity High

Privileges Required None

Scope Changed

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploitation none

Automatable no

Technical Impact total

Vendors	Products
Inducer	Relate

No data.

No data.

References

Link	Providers
https://github.com/inducer/relate/commit/2f68e16cd3b96d25c188c1aa3f7e13cdb15cdaeb
https://github.com/inducer/relate/security/advisories/GHSA-78j7-9xr9-2728

History

Sat, 09 May 2026 00:15:00 +0000

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}`

Fri, 08 May 2026 23:00:00 +0000

Type	Values Removed	Values Added
First Time appeared		Inducer Inducer relate
Vendors & Products		Inducer Inducer relate

Fri, 08 May 2026 15:15:00 +0000

Type	Values Removed	Values Added
Description		RELATE is a web-based courseware package. Prior to commit 2f68e16, there is a timing attack vulnerability in course/auth.py — check_sign_in_key(). This issue has been patched via commit 2f68e16.
Title		RELATE: Timing Attack Vulnerability in course/auth.py — check_sign_in_key()
Weaknesses		CWE-208
References		https://github.com/inducer/relate/commit/2f68e16cd3b96d25c188c1aa3f7e13cdb15cdaeb https://github.com/inducer/relate/security/advisories/GHSA-78j7-9xr9-2728
Metrics		cvssV3_1 `{'score': 9, 'vector': 'CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H'}`

MITRE

Status: PUBLISHED

Assigner: GitHub_M

Published: 2026-05-08T14:51:04.993Z

Updated: 2026-05-08T23:27:23.515Z

Reserved: 2026-04-21T14:15:21.959Z

Link: CVE-2026-41588

Vulnrichment

Updated: 2026-05-08T23:27:10.413Z

NVD

Status : Awaiting Analysis

Published: 2026-05-08T15:16:43.363

Modified: 2026-05-08T16:08:15.570

Link: CVE-2026-41588

Redhat

No data.

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-41588", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2026-04-21T14:15:21.959Z", "datePublished": "2026-05-08T14:51:04.993Z", "dateUpdated": "2026-05-08T23:27:23.515Z"}, "containers": {"cna": {"title": "RELATE: Timing Attack Vulnerability in course/auth.py \u2014 check_sign_in_key()", "problemTypes": [{"descriptions": [{"cweId": "CWE-208", "lang": "en", "description": "CWE-208: Observable Timing Discrepancy", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H", "version": "3.1"}}], "references": [{"name": "https://github.com/inducer/relate/security/advisories/GHSA-78j7-9xr9-2728", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/inducer/relate/security/advisories/GHSA-78j7-9xr9-2728"}, {"name": "https://github.com/inducer/relate/commit/2f68e16cd3b96d25c188c1aa3f7e13cdb15cdaeb", "tags": ["x_refsource_MISC"], "url": "https://github.com/inducer/relate/commit/2f68e16cd3b96d25c188c1aa3f7e13cdb15cdaeb"}], "affected": [{"vendor": "inducer", "product": "relate", "versions": [{"version": "< 2f68e16cd3b96d25c188c1aa3f7e13cdb15cdaeb", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-05-08T14:51:04.993Z"}, "descriptions": [{"lang": "en", "value": "RELATE is a web-based courseware package. Prior to commit 2f68e16, there is a timing attack vulnerability in course/auth.py \u2014 check_sign_in_key(). This issue has been patched via commit 2f68e16."}], "source": {"advisory": "GHSA-78j7-9xr9-2728", "discovery": "UNKNOWN"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-05-08T23:26:52.211095Z", "id": "CVE-2026-41588", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-05-08T23:27:23.515Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-41588", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-05-08T23:26:52.211095Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-05-08T23:27:10.413Z"}}], "cna": {"title": "RELATE: Timing Attack Vulnerability in course/auth.py \u2014 check_sign_in_key()", "source": {"advisory": "GHSA-78j7-9xr9-2728", "discovery": "UNKNOWN"}, "metrics": [{"cvssV3_1": {"scope": "CHANGED", "version": "3.1", "baseScore": 9, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "HIGH", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}}], "affected": [{"vendor": "inducer", "product": "relate", "versions": [{"status": "affected", "version": "< 2f68e16cd3b96d25c188c1aa3f7e13cdb15cdaeb"}]}], "references": [{"url": "https://github.com/inducer/relate/security/advisories/GHSA-78j7-9xr9-2728", "name": "https://github.com/inducer/relate/security/advisories/GHSA-78j7-9xr9-2728", "tags": ["x_refsource_CONFIRM"]}, {"url": "https://github.com/inducer/relate/commit/2f68e16cd3b96d25c188c1aa3f7e13cdb15cdaeb", "name": "https://github.com/inducer/relate/commit/2f68e16cd3b96d25c188c1aa3f7e13cdb15cdaeb", "tags": ["x_refsource_MISC"]}], "descriptions": [{"lang": "en", "value": "RELATE is a web-based courseware package. Prior to commit 2f68e16, there is a timing attack vulnerability in course/auth.py \u2014 check_sign_in_key(). This issue has been patched via commit 2f68e16."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-208", "description": "CWE-208: Observable Timing Discrepancy"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-05-08T14:51:04.993Z"}}}, "cveMetadata": {"cveId": "CVE-2026-41588", "state": "PUBLISHED", "dateUpdated": "2026-05-08T23:27:23.515Z", "dateReserved": "2026-04-21T14:15:21.959Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2026-05-08T14:51:04.993Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.2"}