CVE-2026-26717
MEDIUMOpenFUN Richie - Auth Bypass
Title source: llmDescription
An issue in OpenFUN Richie (LMS) in src/richie/apps/courses/api.py. The application used the non-constant time == operator for HMAC signature verification in the sync_course_run_from_request function. This allows remote attackers to forge valid signatures and bypass authentication by measuring response time discrepancies
Exploits (1)
github
WORKING POC
10 stars
by XiaomingX · pythonpoc
https://github.com/XiaomingX/data-cve-poc-py-v1/tree/main/2026/CVE-2026-26717
Scores
CVSS v3
4.8
EPSS
0.0007
EPSS Percentile
20.6%
Attack Vector
NETWORK
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N
Classification
CWE
CWE-208
Status
draft
Affected Products (1)
pypi/richie
< 3.3.0PyPI
Timeline
Published
Feb 25, 2026
Tracked Since
Feb 26, 2026