CVE-2026-26717 PoC — Richie 安全漏洞

Source

https://github.com/Rickidevs/CVE-2026-26717

Associated Vulnerability

Title: Richie 安全漏洞 (CVE-2026-26717)
Description:An issue in OpenFUN Richie (LMS) in src/richie/apps/courses/api.py. The application used the non-constant time == operator for HMAC signature verification in the sync_course_run_from_request function. This allows remote attackers to forge valid signatures and bypass authentication by measuring response time discrepancies

Description

I discovered a Timing Attack vulnerability in the Richie LMS, developed by France Université Numérique (OpenFUN), and it was assigned the ID CVE-2026-26717 by MITRE.

File Snapshot

Remarks

1. It is advised to access via the original source first.

2. Local POC snapshots are reserved for subscribers — if the original source is unavailable, the local mirror is part of the paid plan.

View subscription plans →