CVE-2026-26717

MEDIUM

Richie < 3.3.0 - Observable Timing Discrepancy in HMAC Signature Verification

Title source: llm
STIX 2.1

Exploitation Summary

EIP tracks 2 public exploits for CVE-2026-26717. PoCs published by XiaomingX, Rickidevs.

AI-analyzed exploit summary This repository contains a functional SQL injection exploit for CVE-2025-10042, targeting WordPress Quiz Maker plugin versions <= 6.7.0.56. The exploit uses time-based blind SQLi to extract admin credentials and hashes.

Description

An issue in OpenFUN Richie (LMS) in src/richie/apps/courses/api.py. The application used the non-constant time == operator for HMAC signature verification in the sync_course_run_from_request function. This allows remote attackers to forge valid signatures and bypass authentication by measuring response time discrepancies

Exploits (2)

github WORKING POC 10 stars
by XiaomingX · pythonpoc
https://github.com/XiaomingX/data-cve-poc-py-v1/tree/main/2026/CVE-2026-26717

This repository contains a functional SQL injection exploit for CVE-2025-10042, targeting WordPress Quiz Maker plugin versions <= 6.7.0.56. The exploit uses time-based blind SQLi to extract admin credentials and hashes.

Classification
Working Poc 95%
Attack Type
Sqli
Complexity
Moderate
Reliability
Reliable
Target: WordPress Quiz Maker <= 6.7.0.56
No auth needed
Prerequisites: target WordPress URL · path to quiz page · vulnerable plugin version
devstral-2 · analyzed Feb 27, 2026 Full analysis →
nomisec WRITEUP
by Rickidevs · poc
https://github.com/Rickidevs/CVE-2026-26717

This repository provides a detailed technical analysis of CVE-2026-26717, a HMAC timing attack vulnerability in OpenFUN Richie LMS. It explains the root cause, impact, and fix, including code snippets and references to the fix commit.

Classification
Writeup 100%
Attack Type
Auth Bypass
Complexity
Moderate
Reliability
Reliable
Target: OpenFUN Richie (all versions prior to commit a1b5bbd)
No auth needed
Prerequisites: Network access to the target system · Ability to send crafted HTTP requests
devstral-2 · analyzed May 04, 2026 Full analysis →

References (3)

Core 3

Scores

CVSS v3 4.8
EPSS 0.0008
EPSS Percentile 23.0%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N

CISA SSVC

Vulnrichment
Exploitation poc
Automatable no
Technical Impact partial

Details

CWE
CWE-208
Status published
Products (1)
pypi/richie 0 - 3.3.0PyPI
Published Feb 25, 2026
Tracked Since Feb 26, 2026