Read the docs
TI-2026-38680 Aliases CVE-2026-53636

Open edX LTI OAuth Replay Attack

Priority MEDIUM 55CWE-294Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
Required
Attack complexity
High
Impact type
Security bypass
Confidentiality · integrity · availability
Low · Low · None
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-294.

Summary

Open edX Platform enables the authoring and delivery of online learning at any scale. Prior to commit 3a5ac85, a security vulnerability has been identified in the Open edX LMS platform's LTI (Learning Tools Interoperability) Provider implementation. The validate_timestamp_and_nonce function in lms/djangoapps/lti_provider/signature_validator.py does not validate OAuth nonces or timestamps, allowing an attacker who captures a valid LTI launch request to replay it an unlimited number of times without detection. This issue has been patched via commit 3a5ac85.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.0028 20th percentileScored 2026-11-07
Fix Fixed openedx-platform (openedx): 3a5ac856c79557c5c74d8b3e6578f289d7cceecd

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Poc
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
openedxopenedx-platformbefore 3a5ac856c79557c5c74d8b3e6578f289d7cceecd3a5ac856c79557c5c74d8b3e6578f289d7cceecdPatch availableCNA
  • openedx-platform Vendoropenedx Affected before 3a5ac856c79557c5c74d8b3e6578f289d7cceecd Fixed in 3a5ac856c79557c5c74d8b3e6578f289d7cceecd Patch available CNA

CPE names Threatist (inferred) · 1

Inferred from how NVD named this product before; not given by a source.

CPEVersionsRoleVendor
cpe:2.3:a:openedx:openedx:*:*:*:*:*:*:*:*——openedx
  • cpe:2.3:a:openedx:openedx:*:*:*:*:*:*:*:* Versions — — ·openedx

Remediation

  • Fix · CNA openedx-platform (openedx) Fixed in 3a5ac856c79557c5c74d8b3e6578f289d7cceecd

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-53636

References

Other 4

  • TI-2026-31065 Open edX Platform: Server-Side Request Forgery (SSRF) in SAML Provider Data Sync Endpoint CVSS 3.1CRITICAL 9.9
  • TI-2022-22791 Drag and Drop XBlock v2 has XSS Issues in Xblock Input Fields CVSS 3.1HIGH 8.4
  • TI-2026-31067 Open edx Enterprise Service: SSRF via SAML metadata URL in sync_provider_data endpoint CVSS 3.1HIGH 8.5
  • TI-2026-38679 Open edX Platform: Insufficient Permission on set_course_mode_price() CVSS 3.1HIGH 7.6
  • TI-2026-26980 Open edX Platform: Account Activation Bypass via activation_key Exposure in REST API CVSS 3.1MEDIUM 5.3
  • TI-2026-27540 Open edX Platform has an Open Redirect in Survey Views via Unvalidated redirect_url Parameter CVSS 3.1MEDIUM 6.1
See all 17 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences