CVE-2026-53636
Received Received - Intake

LTI Replay Attack in Open edX LMS Platform

Publication date: 2026-09-02

Last updated on: 2026-09-02

Assigner: GitHub, Inc.

Description
Open edX Platform enables the authoring and delivery of online learning at any scale. Prior to commit 3a5ac85, a security vulnerability has been identified in the Open edX LMS platform's LTI (Learning Tools Interoperability) Provider implementation. The validate_timestamp_and_nonce function in lms/djangoapps/lti_provider/signature_validator.py does not validate OAuth nonces or timestamps, allowing an attacker who captures a valid LTI launch request to replay it an unlimited number of times without detection. This issue has been patched via commit 3a5ac85.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-02
Last Modified
2026-09-02
Generated
2026-09-02
AI Q&A
2026-09-02
EPSS Evaluated
N/A
NVD
CVE-2026-53636
EUVD
EUVD-2026-70222

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
openedx openedx_platform to 3a5ac85 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-294 A capture-replay flaw exists when the design of the product makes it possible for a malicious user to sniff network traffic and bypass authentication by replaying it to the server in question to the same effect as the original message (or with minor changes).

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is an OAuth nonce replay attack in the Open edX LMS platform's LTI Provider implementation. The validate_timestamp_and_nonce function did not validate OAuth nonces or timestamps, allowing attackers to capture a valid LTI launch request and replay it multiple times without detection.

Detection Guidance

Detecting this vulnerability requires checking if the Open edX platform's LTI provider is running an unpatched version. Inspect the validate_timestamp_and_nonce function in lms/djangoapps/lti_provider/signature_validator.py. If it unconditionally returns True without timestamp or nonce validation, the system is vulnerable. Use commands like grep to search for the function and check its implementation.

Impact Analysis

An attacker could replay captured LTI requests to gain unauthorized access to courses, grades, or assignments. This requires no privileges or user interaction beyond initiating a session and could lead to data breaches or unauthorized actions in the learning platform.

Compliance Impact

This vulnerability could impact compliance with GDPR and HIPAA by allowing unauthorized replay of LTI launch requests, potentially exposing sensitive user data such as course content, grades, or assignments. The lack of nonce and timestamp validation may violate requirements for secure authentication and access control under these regulations.

Mitigation Strategies

Apply the patch from commit 3a5ac85 or later to implement OAuth nonce replay protection. Ensure a shared cache backend (Redis or Memcached) is configured for multi-node deployments. Verify the validate_timestamp_and_nonce function now rejects stale timestamps and checks nonces atomically.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-53636. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart