What is CVE-2026-53636?

CVE-2026-53636 is a medium-severity vulnerability in Openedx Openedx-Platform, classified under Authentication Bypass by Capture-replay. CVSS score: 4.7/10. Published 2026-09-02.

How severe is CVE-2026-53636?

Medium severity. CVSS v3 base score is 4.7 out of 10.

Vulnerability in Openedx Openedx-Platform

CVE-2026-53636

Open edX Platform enables the authoring and delivery of online learning at any scale. Prior to commit 3a5ac85, a security vulnerability has been identified in the Open edX LMS platform's LTI (Learning Tools Interoperability) Provider implementation. The validate_timestamp_and_nonce function in lms/djangoapps/lti_provider/signature_validator.py does not validate OAuth nonces or timestamps, allowing an attacker who captures a valid LTI launch request to replay it an unlimited number of times without detection. This issue has been patched via commit 3a5ac85.

CVSS v3 metric

CVSS v3 base score 4.7 (Medium). Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:N.

Affected products

Openedx Openedx-platform — versions < 3a5ac856c79557c5c74d8b3e6578f289d7cceecd

Weakness classification (CWE)

CWE-294 — Authentication Bypass by Capture-replay

References

security-advisories@github.com (x_refsource_CONFIRM)
security-advisories@github.com (x_refsource_MISC)
security-advisories@github.com (x_refsource_MISC)
security-advisories@github.com (x_refsource_MISC)

Frequently asked questions

What is CVE-2026-53636?: CVE-2026-53636 is a medium-severity vulnerability in Openedx Openedx-Platform, classified under Authentication Bypass by Capture-replay. CVSS score: 4.7/10. Published 2026-09-02.
How severe is CVE-2026-53636?: Medium severity. CVSS v3 base score is 4.7 out of 10.