Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
8.7
CVE-2026-41505: RELATE courseware creates predictable sign-in and exam tokens
CVE-2026-41505 · published 6 months ago
Summary
In versions of RELATE released before a recent update, the system generated login keys and exam ticket codes in a way that could be guessed. This could let someone gain unauthorized access to user accounts or exam sessions. Update RELATE to the latest version that includes the fix from the recent commit.
Original advisory text
RELATE: Predictable Token Generation in auth.py and exam.py
RELATE is a web-based courseware package. Prior to commit 2f68e16, RELATE is vulnerable to predictable token generation in auth.py's make_sign_in_key() function and exam.py's gen_ticket_code() function. This issue has been patched via commit 2f68e16.
References
- https://github.com/inducer/relate/security/advisories/GHSA-rvx5-95mm-p77v Vendor Advisory
- https://github.com/inducer/relate/commit/2f68e16cd3b96d25c188c1aa3f7e13cdb15cdae... Patch
- https://nvd.nist.gov/vuln/detail/CVE-2026-41505 Vendor Advisory
- https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/41xxx/CVE-2026-41505... Vendor Advisory
Internet-facing
60 days
Internal
At next upgrade
- Not known to be exploited
- Needs hands-on effort to exploit
- Gives an attacker partial control
Type
CWE-330Use of Insufficiently Random Values
CWE-338Use of Cryptographically Weak Pseudo-Random Number Generator (PRNG)
Timeline
Published7 May 2026
Updated4 Nov 2026
First seen7 May 2026
Track software like this
Free during beta