ZeroDay Findings
Sign inSign up

Findings

CVE-2026-26717

An issue in OpenFUN Richie (LMS) in src/richie/apps/courses/api.py.

Published Feb 25, 2026 · updated Jun 17, 2026

An issue in OpenFUN Richie (LMS) in src/richie/apps/courses/api.py. The application used the non-constant time == operator for HMAC signature verification in the sync_course_run_from_request function. This allows remote attackers to forge valid signatures and bypass authentication by measuring response time discrepancies

Code

The project this record applies to. Exploit listings stay in References.

Timeline

Detection, updates, and resolution for this record.

  1. Feb 25, 2026 · NIST NVD

    Detected

    An issue in OpenFUN Richie (LMS) in src/richie/apps/courses/api.py. The application used the non-constant time == operator for HMAC signature verification in the sync_course_run_from_request function. This allows remote attackers to forge valid signatures and bypass authentication by measuring response time discrepancies

  2. Jun 17, 2026 · NIST NVD

    Updated

    An issue in OpenFUN Richie (LMS) in src/richie/apps/courses/api.py. The application used the non-constant time == operator for HMAC signature verification in the sync_course_run_from_request function. This allows remote attackers to forge valid signatures and bypass authentication by measuring response time discrepancies

Sources

  • CVE.orgVulnerability recordCVE-2026-26717

    Official CVE identifier

    cve.org
  • NIST NVDVulnerability recordCVE-2026-26717

    An issue in OpenFUN Richie (LMS) in src/richie/apps/courses/api.py. The application used the non-constant time == operator for HMAC signature verification in the sync_course_run_from_request function. This allows remote attackers to forge valid signatures and bypass authenticatio

    nvd.nist.gov

References