Vulnerability · Published Sep 2, 2026 · Assigned by GitHub_M

CVE-2026-53636Open edX LTI OAuth Replay Attack

Medium 4.7

In plain English

A medium-severity security flaw in openedx-platform from openedx. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 21% of all known vulnerabilities).

Severity (CVSS 3.1)4.7Medium

Exploit odds (30 days)0.3%top 79.4% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack toolingNoneno public tooling known

Official description

Open edX Platform enables the authoring and delivery of online learning at any scale. Prior to commit 3a5ac85, a security vulnerability has been identified in the Open edX LMS platform's LTI (Learning Tools Interoperability) Provider implementation. The validate_timestamp_and_nonce function in lms/djangoapps/lti_provider/signature_validator.py does not validate OAuth nonces or timestamps, allowing an attacker who captures a valid LTI launch request to replay it an unlimited number of times without detection. This issue has been patched via commit 3a5ac85.

Affected products (as reported)

Vendor	Product	Versions
openedx	openedx-platform	< 3a5ac856c79557c5c74d8b3e6578f289d7cceecd

Weakness: CWE-294 · Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:N

References

https://github.com/openedx/openedx-platform/security/advisories/GHSA-6gm5-c49g-p3h9 x_refsource_CONFIRM
https://github.com/openedx/openedx-platform/commit/0a92cf25de8844bf840ffd5d18dcfd940031a2ba x_refsource_MISC
https://github.com/openedx/openedx-platform/commit/3a5ac856c79557c5c74d8b3e6578f289d7cceecd x_refsource_MISC
https://github.com/openedx/openedx-platform/commit/50af17b05d82a8c7e8e690cc2783a8a0ba330bc3 x_refsource_MISC