CVE-2026-41588

The check_sign_in_key() function in the course/auth.py file compares login keys in a way that is vulnerable to timing attacks (CWE-208). An attacker, by sending appropriately crafted requests and measuring server response times, can gradually guess the correct key value character by character. The vulnerability does not require authentication or user interaction, however its effective exploitation requires appropriate network conditions (high attack complexity).

Successful exploitation of this vulnerability allows an attacker to guess the secret login key, which may lead to unauthorized access to the system with potentially serious consequences for the confidentiality, integrity, and availability of course data and user information.

The RELATE installation should be updated to a version containing commit 2f68e16cd3b96d25c188c1aa3f7e13cdb15cdaeb or later. Details are available in the project references on GitHub (GHSA-78j7-9xr9-2728).

All versions of the RELATE system prior to commit 2f68e16 (project available at github.com/inducer/relate)