TI-2026-30141 Aliases CVE-2026-41588

RELATE: Timing Attack Vulnerability in course/auth.py — check_sign_in_key()

MEDIUM 41CWE-208Published 2026-05-08 · Updated 2026-05-08

Key facts

Attack vector: Network
Privileges required: None
User interaction: None
Attack complexity: High
Impact type: Information disclosure
Confidentiality · integrity · availability: High · High · High
Fix status: Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-208.

Summary

RELATE is a web-based courseware package. Prior to commit 2f68e16, there is a timing attack vulnerability in course/auth.py — check_sign_in_key(). This issue has been patched via commit 2f68e16.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV

EPSS 0.00362 30th percentileScored 2026-11-07

Fix Fixed relate (inducer): 2f68e16cd3b96d25c188c1aa3f7e13cdb15cdaeb

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: None
Automatable: No
Technical impact: Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
inducer	relate	before 2f68e16cd3b96d25c188c1aa3f7e13cdb15cdaeb	2f68e16cd3b96d25c188c1aa3f7e13cdb15cdaeb	Patch available	CNA

relate Vendorinducer Affected before 2f68e16cd3b96d25c188c1aa3f7e13cdb15cdaeb Fixed in 2f68e16cd3b96d25c188c1aa3f7e13cdb15cdaeb Patch available CNA

CPE configurations NVD · 1

CPE	Versions	Role	Vendor
cpe:2.3:a:inducer:relate::::::::	before 2026-04-17	Vulnerable	inducer

cpe:2.3:a:inducer:relate:*:*:*:*:*:*:*:* Versions before 2026-04-17 Vulnerable ·inducer

Remediation

Fix · CNA relate (inducer) Fixed in 2f68e16cd3b96d25c188c1aa3f7e13cdb15cdaeb

Timeline

2026-10-02 Threatist record created from CVE-2026-41588

References

Patch 1

https://github.com/inducer/relate/commit/2f68e16cd3b96d25c188c1aa3f7e13cdb15cdaeb

Advisory 1

https://github.com/inducer/relate/security/advisories/GHSA-78j7-9xr9-2728

TI-2024-21319 Server-Side Template Injection (SSTI) vulnerability in inducer relate before v.2024.1… CVSS 3.1HIGH 7.5
TI-2024-21317 Server-Side Template Injection (SSTI) vulnerability in inducer relate before v.2024.1… CVSS 3.1MEDIUM 6.0
TI-2024-21320 An issue in inducer relate before v.2024.1 allows a remote attacker to execute arbitrary… CVSS 3.1HIGH 8.8
TI-2024-21318 Cross Site Scripting vulnerability in inducer relate before v.2024.1 allows a remote… CVSS 3.1LOW 2.6

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences