RELATE courseware CVE-2026-41505

Update RELATE to commit 2f68e16cd3b96d25c188c1aa3f7e13cdb15cdaeb or later, which replaces weak PRNG implementations with cryptographically secure random generation. Patch available at https://github.com/inducer/relate/commit/2f68e16cd3b96d25c188c1aa3f7e13cdb15cdaeb. For environments unable to immediately patch, implement compensating controls: (1) Rotate all existing authentication tokens and exam tickets to invalidate potentially compromised credentials-disrupts active sessions but prevents token reuse. (2) Enable aggressive rate limiting on authentication endpoints (10 attempts per IP per hour) to increase computational cost of token prediction attacks-may impact legitimate users in shared network environments. (3) Implement anomalous authentication pattern detection (multiple failed token validations, rapid token enumeration attempts) with temporary IP blocking-requires log analysis infrastructure. (4) Restrict exam access windows to shortest practical duration and invalidate tickets immediately upon exam completion-reduces window for ticket prediction but may affect students with technical difficulties. None of these workarounds address root cause; upgrade remains essential for production environments hosting sensitive assessments.