CVE-2026-26717 OpenFUN Richie Observable Timing Discrepancy in its sync_course_run_from_request function
Remote attackers can bypass authentication in OpenFUN Richie LMS by exploiting a timing side-channel in HMAC signature verification to forge valid signatures.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-26717?
CVE-2026-26717 is a medium-severity authentication bypass vulnerability in n/a, published on 25 Feb 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
An issue in OpenFUN Richie (LMS) in src/richie/apps/courses/api.py. The application used the non-constant time == operator for HMAC signature verification in the sync_course_run_from_request function. This allows remote attackers to forge valid signatures and bypass authentication by measuring response time discrepancies
Weakness: CWE-208
Which versions are affected by CVE-2026-26717?
3 open source packages ship an affected version, including richie.
| Package | Affected | Fixed in |
|---|---|---|
richie PyPI | All versions | 3.3.0 |
richie PyPI | All versions | 3.3.0 |
richie PyPI | All versions | 3.3.0 |
How do I fix CVE-2026-26717?
Upgrade richie to 3.3.0 or later.
Upgrade, and rotate credentials and sessions that may have been exposed. More about Authentication bypass.
Is CVE-2026-26717 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-26717 exists.
Public exploit code: 1 proofs of concept on GitHub.
Sources
Also known as GHSA-xjhr-fm27-4hmx, PYSEC-2026-3052.