Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.

CVE-2026-41588: RELATE can leak sign‑in keys through timing differences

CVE-2026-41588 · published 6 months ago

Summary

The RELATE learning system’s sign‑in check measured how long it took to compare passwords, which could let an attacker guess the correct key. This risk has been fixed in the latest code update. Apply the recent RELATE update to remove the issue.

What to do

Update inducer relate to version 2026-04-17 or later.

Affected software

Vendor	Product	Affected versions
inducer	relate	< 2026-04-17 `cpe:2.3:a:inducer:relate::::::::`

Original advisory text

RELATE: Timing Attack Vulnerability in course/auth.py — check_sign_in_key()

RELATE is a web-based courseware package. Prior to commit 2f68e16, there is a timing attack vulnerability in course/auth.py — check_sign_in_key(). This issue has been patched via commit 2f68e16.

References

https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/41xxx/CVE-2026-41588... Vendor Advisory
https://github.com/inducer/relate/security/advisories/GHSA-78j7-9xr9-2728 Vendor Advisory
https://nvd.nist.gov/vuln/detail/CVE-2026-41588 Vendor Advisory
https://github.com/inducer/relate/commit/2f68e16cd3b96d25c188c1aa3f7e13cdb15cdae... Patch

Fix within

Internet-facing 14 days

Internal At next upgrade

Not known to be exploited
Needs hands-on effort to exploit
Gives an attacker full control

Severity

9.0 Critical

Exploitation

<1% chance of attack within 30 days

Type

CWE-208Observable Timing Discrepancy

CWE-203Observable Discrepancy

Timeline

Published8 May 2026

Updated4 Nov 2026

First seen8 May 2026

Sources

CVE-2026-41588 · NVD

CVE-2026-41588 · OSV

GHSA-78j7-9xr9-2728 · GHSA

Track software like this

Free during beta