CVE-2026-53636— Open edX LTI OAuth Replay Attack
Quick assessment
Affected
openedx openedx-platform
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
Open edX 平台支持以任意规模进行在线学习的创建与交付。在提交 之前，Open edX LMS 平台中的 LTI（学习工具互操作性）Provider 实现中存在一个安全漏洞。位于 中的 函数未对 OAuth nonce 或时间戳进行验证，导致攻击者在捕获一个有效的 LTI 启动请求后，可以将其无限次重放而不会被检测到。该问题已通过提交 修复。
Possible ATT&CK Techniques 2 AI
T1189 · Drive-by Compromise T1190 · Exploit Public-Facing Application
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-53636
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Open edX LTI OAuth Replay Attack
Source: CVE Program / CVE List V5
Vulnerability Description
Open edX Platform enables the authoring and delivery of online learning at any scale. Prior to commit 3a5ac85, a security vulnerability has been identified in the Open edX LMS platform's LTI (Learning Tools Interoperability) Provider implementation. The validate_timestamp_and_nonce function in lms/djangoapps/lti_provider/signature_validator.py does not validate OAuth nonces or timestamps, allowing an attacker who captures a valid LTI launch request to replay it an unlimited number of times without detection. This issue has been patched via commit 3a5ac85.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:N
Source: CVE Program / CVE List V5
Vulnerability Type
使用捕获-重放进行的认证绕过
Source: CVE Program / CVE List V5
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| openedx | openedx-platform | < 3a5ac856c79557c5c74d8b3e6578f289d7cceecd | - |
|
II. Public POCs for CVE-2026-53636
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-53636
请登录查看更多情报信息。
Patches & Fixes for CVE-2026-53636 (3)
Vendor Advisories for CVE-2026-53636 (1)
Same Patch Batch · openedx · 2026-09-02 · 3 CVEs total
| CVE-2026-53635 | 7.6 HIGH | Open edX Platform: Insufficient Permission on set_course_mode_price() |
| CVE-2026-55421 | 6.8 MEDIUM | Open edX Platform: SSRF in Studio Video Download Endpoint |
IV. Related Vulnerabilities
Same product: openedx-platform
-
CVE-2026-55421
Open edX Platform: SSRF in Studio Video Download Endpoint -
CVE-2026-53635
Open edX Platform: Insufficient Permission on set_course_mod -
CVE-2026-42857
Open edX Platform: Stored CSS Injection in Email Notificatio -
CVE-2026-42858
Open edX Platform: Server-Side Request Forgery (SSRF) in SAM -
CVE-2026-35404
Open edX Platform has an Open Redirect in Survey Views via U
Same vendor: openedx
-
CVE-2026-55421
Open edX Platform: SSRF in Studio Video Download Endpoint -
CVE-2026-53635
Open edX Platform: Insufficient Permission on set_course_mod -
CVE-2026-42860
Open edx Enterprise Service: SSRF via SAML metadata URL in s -
CVE-2026-42857
Open edX Platform: Stored CSS Injection in Email Notificatio -
CVE-2026-42858
Open edX Platform: Server-Side Request Forgery (SSRF) in SAM
Same weakness: CWE-294
-
CVE-2026-12704
CVE-2026-12704 CVE Record -
CVE-2026-84306
Filament: Multi-factor authentication (app) codes can still -
CVE-2026-82470
Rodauth before 2.47.0 TOTP Code Reuse via Drift Window -
CVE-2026-13734
Zephyr WireGuard mutates peer state before anti-replay check -
CVE-2026-82220
WordPress Forminator plugin <= 1.57.1 - Other vulnerability
V. Comments for CVE-2026-53636
No comments yet