CVE-2026-53636

Open edX Platform enables the authoring and delivery of online learning at any scale. Prior to commit 3a5ac85, a security vulnerability has been identified in the Open edX LMS platform's LTI Learning Tools Interoperability Provider implementation. The validatetimestampandnonce function in...

EUVD-2026-70222

Open edX Platform enables the authoring and delivery of online learning at any scale. Prior to commit 3a5ac85, a security vulnerability has been identified in the Open edX LMS platform's LTI Learning Tools Interoperability Provider implementation. The validatetimestampandnonce function in...

CVE-2026-53636 Open edX LTI OAuth Replay Attack

Open edX Platform enables the authoring and delivery of online learning at any scale. Prior to commit 3a5ac85, a security vulnerability has been identified in the Open edX LMS platform's LTI Learning Tools Interoperability Provider implementation. The validatetimestampandnonce function in...

CVE-2026-53636

The Open edX LMS platform has a replay vulnerability in its LTI (Learning Tools Interoperability) Provider implementation. The validate_timestamp_and_nonce function in lms/djangoapps/lti_provider/signature_validator.py does not validate OAuth nonces or timestamps, allowing an attacker who capture...

about-hmac

HMAC 소개 Python에서 Flask를 사용한 기본 HMAC해시 기반 메시지 인증 코드 구현 예제입니다. HMAC이란?! 해시 기반 메시지 인증 코드HMAC는 서버와 클라이언트 각각에 해당 특정 서버와 클라이언트만 알 수 있는 개인 키를 제공합니다. 클라이언트는 요청 데이터를 개인 키로 해싱하여 요청의 일부로 전송함으로써 서버에 대한 각 요청마다 고유한 HMAC해시를 생성합니다. HMAC이 MAC메시지 인증 코드보다 더 안전한 이유는 키와 메시지가 별도의 단계로 해시되기 때문입니다. 예제 1 클라이언트의 서버 요청 클라이언...

CVE-2026-76245 stigmem Federation Peer Token Timestamp Validation Bypass

stigmem pip package stigmem-node version 0.9.0a1 contains a timestamp-handling mismatch in federation peer-token validation that can cause valid peer tokens to be incorrectly treated as expired. This affects the availability and reliability of authenticated federation flows on nodes using...

CVE-2026-76245 stigmem Federation Peer Token Timestamp Validation Bypass

stigmem pip package stigmem-node version 0.9.0a1 contains a timestamp-handling mismatch in federation peer-token validation that can cause valid peer tokens to be incorrectly treated as expired. This affects the availability and reliability of authenticated federation flows on nodes using...

Linux Distros Unpatched Vulnerability : CVE-2026-54787

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - sigstore-go is a Go library for Sigstore signing and verification. Prior to 1.2.1, sigstore-go does not check a bundle signing timestamp against the validity...

AZL-94425 CVE-2026-54787 affecting package gh 2.62.0-20

sigstore-go is a Go library for Sigstore signing and verification. Prior to 1.2.1, sigstore-go does not check a bundle signing timestamp against the validity window of an ExpiringKey wrapping a self-managed long-lived signing key without a certificate, which can allow an attacker holding expired...

DEBIAN-CVE-2026-54787

sigstore-go is a Go library for Sigstore signing and verification. Prior to 1.2.1, sigstore-go does not check a bundle signing timestamp against the validity window of an ExpiringKey wrapping a self-managed long-lived signing key without a certificate, which can allow an attacker holding expired...

UBUNTU-CVE-2026-54787

sigstore-go is a Go library for Sigstore signing and verification. Prior to 1.2.1, sigstore-go does not check a bundle signing timestamp against the validity window of an ExpiringKey wrapping a self-managed long-lived signing key without a certificate, which can allow an attacker holding expired...

CVE-2026-54787 sigstore-go fails to check signature timestamps against a signing key's validity period

sigstore-go is a Go library for Sigstore signing and verification. Prior to 1.2.1, sigstore-go does not check a bundle signing timestamp against the validity window of an ExpiringKey wrapping a self-managed long-lived signing key without a certificate, which can allow an attacker holding expired...

EUVD-2026-51359

The GOOSE subscriber component improperly validates the UTC timestamp field in unauthenticated IEC 61850 GOOSE EtherType 0x88B8 Layer-2 multicast messages. A specially crafted GOOSE frame containing an undersized timestamp field can trigger a heap out-of-bounds read during message processing,...

PT-2026-66634

Name of the Vulnerable Software and Affected Versions The product name cannot be determined affected versions not specified Description The GOOSE subscriber component fails to properly validate the UTC timestamp field in unauthenticated IEC 61850 GOOSE EtherType 0x88B8 Layer-2 multicast messages...

BIT-KIBANA-2026-33463 Operation on a Resource after Expiration or Termination in Kibana Leading to Unauthorized File Access

Operation on a Resource after Expiration or Termination CWE-672 in Kibana can lead to unauthorized information disclosure. A logic error in how expiration timestamps were validated allowed a time-bounded access token to remain usable beyond its intended validity window, enabling an unauthenticate...

stigmem-node's federation peer token timestamp validation may reject valid peer tokens

Impact A mismatch in federation peer-token timestamp handling could cause valid peer tokens to be treated as expired. Impacted deployments are Stigmem nodes using federation peer authentication paths from affected versions. The primary impact is availability and reliability of authenticated...

CVE-2026-33463

Operation on a Resource after Expiration or Termination CWE-672 in Kibana can lead to unauthorized information disclosure. A logic error in how expiration timestamps were validated allowed a time-bounded access token to remain usable beyond its intended validity window, enabling an unauthenticate...

CVE-2026-40093

nimiq-blockchain provides persistent block storage for Nimiq's Rust implementation. In 1.3.0 and earlier, block timestamp validation enforces that timestamp = parent.timestamp for non-skip blocks and timestamp == parent.timestamp + MINPRODUCERTIMEOUT for skip blocks, but there is no visible upper...

Improper Check for Unusual or Exceptional Conditions

Overview Affected versions of this package are vulnerable to Improper Check for Unusual or Exceptional Conditions due to missing timestamp validation in the Zoom webhook handler. An attacker can corrupt meeting state by replaying webhook requests. Remediation Upgrade...

CVE-2026-3109 Missing timestamp validation in Zoom webhook handler

Mattermost Plugins versions =11.4 10.11.11.0 fail to validate webhook request timestamps which allows an attacker to corrupt Zoom meeting state in Mattermost via replayed webhook requests. Mattermost Advisory ID: MMSA-2026-00584...