CVE-2026-26717: Observable Timing Discrepancy

An issue in OpenFUN Richie LMS in src/richie/apps/courses/api.py. The application used the non-constant time == operator for HMAC signature verification in the synccourserunfromrequest function. This allows remote attackers to forge valid signatures and bypass authentication by measuring response...

CVE-2026-26717

The OpenFUN Richie (LMS) platform is vulnerable to an HMAC timing attack due to the use of a non-constant time == operator during signature verification. The flaw exists in the sync_course_run_from_request function within src/richie/apps/courses/api.py. This allows remote attackers to forge valid...