CVE-2026-41588 PUBLISHED

RELATE: Timing Attack Vulnerability in course/auth.py — check_sign_in_key()

Assigner: GitHub_M
Reserved: 21.04.2026 Published: 08.05.2026 Updated: 08.05.2026

RELATE is a web-based courseware package. Prior to commit 2f68e16, there is a timing attack vulnerability in course/auth.py — check_sign_in_key(). This issue has been patched via commit 2f68e16.

Metrics

CVSS 3.1

CVSS Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H
CVSS Score: 9

Attack Vector	Network	Scope	Changed
Attack Complexity	High	Confidentiality Impact	High
Privileges Required	None	Integrity Impact	High
User Interaction	None	Availability Impact	High

CVSS 3.1

Product Status

Vendor	inducer
Product	relate
Versions	Version < 2f68e16cd3b96d25c188c1aa3f7e13cdb15cdaeb is affected

References

https://github.com/inducer/relate/security/advisories/GHSA-78j7-9xr9-2728
https://github.com/inducer/relate/commit/2f68e16cd3b96d25c188c1aa3f7e13cdb15cdaeb

Problem Types

CWE-208: Observable Timing Discrepancy CWE