EUVD-2026-70222Severity by source
AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:N
AC:H reflects mandatory prior capture of a signed LTI request; UI:R requires a legitimate user to initiate the launch; S:C applies because replay crosses into the external LTI tool boundary.
Primary rating from Vendor (GitHub_M).
CVSS VectorVendor: GitHub_M
Lifecycle Timeline
4DescriptionCVE.org
Open edX Platform enables the authoring and delivery of online learning at any scale. Prior to commit 3a5ac85, a security vulnerability has been identified in the Open edX LMS platform's LTI (Learning Tools Interoperability) Provider implementation. The validate_timestamp_and_nonce function in lms/djangoapps/lti_provider/signature_validator.py does not validate OAuth nonces or timestamps, allowing an attacker who captures a valid LTI launch request to replay it an unlimited number of times without detection. This issue has been patched via commit 3a5ac85.
AnalysisAI
OAuth nonce replay attacks against Open edX LMS's LTI 1.1 Provider endpoint allow an attacker who intercepts a valid LTI launch request to resubmit it an unlimited number of times, gaining unauthorized access to course content or LTI tool sessions as the original user. Prior to commit 3a5ac85, the validate_timestamp_and_nonce function in lms/djangoapps/lti_provider/signature_validator.py returned True unconditionally, performing neither timestamp window checks nor nonce deduplication, rendering the entire OAuth 1.0a replay-protection layer inert. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires that the LTI Provider feature be enabled on the Open edX instance - it is not active in all deployments and must be explicitly configured with LTI Consumer credentials. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 4.7 Medium rating reflects genuine real-world constraints that limit opportunistic mass exploitation: AC:H encodes the prerequisite that an attacker must first capture a validly signed LTI launch request via network interception or log exfiltration, and UI:R reflects that a legitimate user must initiate the LTI session before a replayable request exists. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | The primary fix is to update Open edX Platform to a revision containing commit 3a5ac856c79557c5c74d8b3e6578f289d7cceecd; operators should consult the GitHub Security Advisory at https://github.com/openedx/openedx-platform/security/advisories/GHSA-6gm5-c49g-p3h9 for the authoritative guidance and any named release that incorporates these commits. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Openedx Platform
View allServer-side request forgery (SSRF) in Open edX Platform allows authenticated Enterprise Admin users to force the applica
Missing authorization on the `set_course_mode_price()` instructor endpoint in Open edX Platform allows any authenticated
Server-Side Request Forgery with full response exfiltration in Open edX Platform's Studio CMS video download endpoint al
Open edX Platform versions prior to commit 76462f1e5fa9b37d2621ad7ad19514b403908970 suffer from an open redirect vulnera
Open edX Platform from maple release through ulmo allows unauthenticated attackers to bypass email verification by explo
Stored cross-site scripting (XSS) via CSS injection in Open edX Platform allows enrolled students to inject arbitrary CS
Same weakness CWE-294 – Authentication Bypass by Capture-replay
View allShare
External POC / Exploit Code
Leaving vuln.today