CVE-2026-41505: RELATE: Predictable Token Generation in auth.py and exam.py

Severity: high (CVSS 8.7 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.3% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2026-05-07 · updated 2026-10-26
Weakness: CWE-330

Description

RELATE is a web-based courseware package. Prior to commit 2f68e16, RELATE is vulnerable to predictable token generation in auth.py's make_sign_in_key() function and exam.py's gen_ticket_code() function. This issue has been patched via commit 2f68e16.

Affected products

inducer relate: before 2f68e16cd3b96d25c188c1aa3f7e13cdb15cdaeb

References

https://github.com/inducer/relate/commit/2f68e16cd3b96d25c188c1aa3f7e13cdb15cdaeb
https://github.com/inducer/relate/security/advisories/GHSA-rvx5-95mm-p77v

Get alerted when CVE-2026-41505 or the next vulnerability affects your stack