CVE-2026-26717: OpenFUN Richie HMAC Signature Forgery Vulnerability
Summary
CVE-2026-26717: OpenFUN Richie Observable Timing Discrepancy in its sync_course_run_from_request function. Affects richie versions < 3.3.0. Fixed in 3.3.0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
OpenFUN Richie is a Learning Management System (LMS) designed to facilitate online education and course management. It provides features such as course creation, user management, and content delivery. However, it has a vulnerability in its HMAC signature verification process, which can be exploited by attackers to bypass authentication.
Vulnerability Detail
The vulnerability arises from the use of a non-constant time equality operator in the HMAC signature verification within the sync_course_run_from_request function of OpenFUN Richie. This flaw allows remote attackers to forge valid signatures by exploiting timing discrepancies in the application's response. As a result, attackers can gain unauthorized access to the system, potentially compromising sensitive user data and course content.
How To Fix
Minimum fixed version
3.3.0
This is the first release that contains the fix.
pip install --upgrade "richie==3.3.0"Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary measure, you can implement additional logging to monitor response times and identify potential signature forgery attempts. However, this is not a substitute for applying the patch.
Conclusion
In summary, the CVE-2026-26717 vulnerability in OpenFUN Richie poses a significant risk due to its flawed HMAC signature verification process. It is crucial for users to update to version 3.3.0 or later to mitigate this risk and ensure the security of their applications.
See every vulnerability recorded for richie →
FAQ
The CVSS score of this vulnerability is 4.8, indicating a moderate severity level.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without requiring any signup.
If exploited, this vulnerability can allow attackers to bypass authentication, leading to unauthorized access to user accounts and sensitive data.
While the best solution is to apply the patch, you can implement additional logging to monitor for suspicious activity as a temporary measure.
You can find more information about OpenFUN Richie on its official documentation and GitHub repository.
