CVEvulnerability

CVE-2026-41505

8.7 HIGH Published 2026-05-07 Modified 2026-10-26 Official page ↗

Status: Awaiting Analysis
Published: 2026-05-07
Last modified: 2026-10-26
Assigner: [email protected]
CVSS 3.1 ([email protected]): 8.7 HIGH — CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:N/I:H/A:H
Weaknesses: CWE-330, CWE-338

Description

RELATE is a web-based courseware package. Prior to commit 2f68e16, RELATE is vulnerable to predictable token generation in auth.py's make_sign_in_key() function and exam.py's gen_ticket_code() function. This issue has been patched via commit 2f68e16.

Weakness · CWE (2)

CWE-330 Use of Insufficiently Random Values weakness
CWE-338 Use of Cryptographically Weak Pseudo-Random Number Generator (PRNG) weakness

References

https://github.com/inducer/relate/commit/2f68e16cd3b96d25c188c1aa3f7e13cdb15cdaeb github.com
https://github.com/inducer/relate/security/advisories/GHSA-rvx5-95mm-p77v github.com

CVE-2026-41505

Description

Related

Weakness · CWE (2)

References