EUVD-2026-28656CVSS VectorNVD
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H
Lifecycle Timeline
4DescriptionNVD
RELATE is a web-based courseware package. Prior to commit 2f68e16, there is a timing attack vulnerability in course/auth.py - check_sign_in_key(). This issue has been patched via commit 2f68e16.
AnalysisAI
Timing attack vulnerability in RELATE's authentication module allows remote unauthenticated attackers to infer valid sign-in keys through response time analysis. The CWE-208 timing side-channel in course/auth.py's check_sign_in_key() function enables attackers to distinguish between valid and invalid authentication tokens by measuring server response latencies. …
Sign in for full analysis, threat intelligence, and remediation guidance.
RemediationAI
Within 24 hours: Inventory all RELATE deployments and assess whether they are internet-facing or restricted to trusted networks; notify stakeholders of critical authentication risk. Within 7 days: Contact RELATE vendor for ETA on patch delivery and interim guidance; implement network-level controls to rate-limit or segment authentication endpoints if possible. …
Sign in for detailed remediation steps.
Share
External POC / Exploit Code
Leaving vuln.today