CVE-2026-41505 PUBLISHED

RELATE: Predictable Token Generation in auth.py and exam.py

Assigner: GitHub_M
Reserved: 20.04.2026 Published: 07.05.2026 Updated: 07.05.2026

RELATE is a web-based courseware package. Prior to commit 2f68e16, RELATE is vulnerable to predictable token generation in auth.py's make_sign_in_key() function and exam.py's gen_ticket_code() function. This issue has been patched via commit 2f68e16.

Metrics

CVSS 3.1

CVSS Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:N/I:H/A:H
CVSS Score: 8.7

Attack Vector	Network	Scope	Changed
Attack Complexity	High	Confidentiality Impact	None
Privileges Required	None	Integrity Impact	High
User Interaction	None	Availability Impact	High

CVSS 3.1

Product Status

Vendor	inducer
Product	relate
Versions	Version < 2f68e16cd3b96d25c188c1aa3f7e13cdb15cdaeb is affected

References

https://github.com/inducer/relate/security/advisories/GHSA-rvx5-95mm-p77v
https://github.com/inducer/relate/commit/2f68e16cd3b96d25c188c1aa3f7e13cdb15cdaeb

Problem Types

CWE-338: Use of Cryptographically Weak Pseudo-Random Number Generator (PRNG) CWE
CWE-330: Use of Insufficiently Random Values CWE