CVE-2026-53636mediumCWE-294

CVE-2026-53636: medium-severity vulnerability in openedx-platform

Open edX LTI OAuth Replay Attack

Published

Follow this CVE+ Monitor openedx-platform

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

13Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackcvss 4.7epss 0.3%
Open edX Platform enables the authoring and delivery of online learning at any scale. Prior to commit 3a5ac85, a security vulnerability has been identified in the Open edX LMS platform's LTI (Learning Tools Interoperability) Provider implementation. The validate_timestamp_and_nonce function in lms/djangoapps/lti_provider/signature_validator.py does not validate OAuth nonces or timestamps, allowing an attacker who captures a valid LTI launch request to replay it an unlimited number of times without detection. This issue has been patched via commit 3a5ac85.
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:N
Affected products
openedx · openedx-platform
Related CVEs — openedx-platform

In the same product, most dangerous first.

CVE-2026-85272MEDIUMOpen edX Platform: Path traversal via prefix-bypass in safe_extractall Path ValidationEPSS 0.5%CVE-2026-55421MEDIUMOpen edX Platform: SSRF in Studio Video Download EndpointEPSS 0.5%CVE-2026-53635HIGHOpen edX Platform: Insufficient Permission on set_course_mode_price()EPSS 0.4%CVE-2026-42858HIGHOpen edX Platform: Server-Side Request Forgery (SSRF) in SAML Provider Data Sync EndpointEPSS 0.4%CVE-2026-85271MEDIUMOpen edX Platform: Stored CSS Injection in Email Digest Notifications via Unsanitized Thread Title (incomplete patch of CVE-2026-42857)EPSS 0.4%CVE-2026-35404MEDIUMOpen edX Platform has an Open Redirect in Survey Views via Unvalidated redirect_url ParameterEPSS 0.2%