{"id":"CVE-2026-26717","aliases":["GHSA-xjhr-fm27-4hmx","PYSEC-2026-3052"],"title":"OpenFUN Richie Observable Timing Discrepancy in its sync_course_run_from_request function","summary":"OpenFUN Richie Observable Timing Discrepancy in its sync_course_run_from_request function","severity":"medium","cvss":4.8,"cvssVector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N","vendor":"richie","product":"richie","ecosystem":"pip","affected":["richie < 3.3.0"],"patched":["richie 3.3.0"],"published":"2026-02-25","updated":"2026-09-10","sourceUpdated":"2026-09-10T03:50:36.343231578Z","source":"OSV","sourceUrl":"https://osv.dev/vulnerability/GHSA-xjhr-fm27-4hmx","references":[{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-26717"},{"url":"https://github.com/openfun/richie/commit/a1b5bbda3403d7debb466c303a32852925fcba5f"},{"url":"https://github.com/Rickidevs/CVE-2026-26717"},{"url":"https://github.com/openfun/richie"},{"url":"https://medium.com/@ordogh/cve-2026-26717-hmac-timing-attack-in-openfun-richie-lms-f04377efe83d?postPublishedType=repub"}],"tags":["osv","pip","exploit-available"],"epss":0.00376,"epssPercentile":0.31481,"exploits":{"github":1,"githubRepos":["https://github.com/Rickidevs/CVE-2026-26717"],"checkedAt":"2026-09-24T07:53:01.303Z"},"exploitAvailable":true,"ingestedAt":"2026-07-13T18:58:05.178Z","slug":"CVE-2026-26717","body":"## Overview\n\nAn issue in OpenFUN Richie (LMS) in src/richie/apps/courses/api.py. The application used the non-constant time == operator for HMAC signature verification in the sync_course_run_from_request function. This allows remote attackers to forge valid signatures and bypass authentication by measuring response time discrepancies.\n\n## Affected packages\n\n- `richie < 3.3.0`\n\n## Remediation\n\nUpgrade to a patched release:\n\n- `richie 3.3.0`","depth":"twilight","depthScore":38,"depthScoreParts":{"impact":26.4,"likelihood":0.1,"exploitation":12,"ransomware":0},"changes":[{"seq":5050,"id":"CVE-2026-26717","ts":1788887230454,"field":"exploit_available","old":"false","new":"true"},{"seq":3933,"id":"CVE-2026-26717","ts":1788886361222,"field":"exploit_available","old":"true","new":"false"},{"seq":2755,"id":"CVE-2026-26717","ts":1788883027961,"field":"exploit_available","old":"false","new":"true"},{"seq":1784,"id":"CVE-2026-26717","ts":1788882430968,"field":"exploit_available","old":"true","new":"false"},{"seq":890,"id":"CVE-2026-26717","ts":1788881864269,"field":"exploit_available","old":"false","new":"true"}]}