The vulnerability resides in the HMAC signature verification in the sync_course_run_from_request function of OpenFUN Richie LMS. A non‑constant‑time comparison operator is used, which permits an attacker to measure response times and deduce a correct signature. With a forged signature the attacker can bypass authentication and perform actions that are normally restricted to authenticated users.

This flaw affects deployments of OpenFUN Richie LMS where the sync_course_run_from_request endpoint is enabled. The specific code path is located in src/richie/apps/courses/api.py. A remediation commit (a1b5bbda3403d7debb466c303a32852925fcba5f) has been released to replace the comparison with a constant‑time routine. No affected version information is available.

The CVSS score is 4.8, representing a medium severity issue, while the EPSS score is below 1% and the vulnerability is not listed in the CISA KEV catalog. The attack vector is inferred to be remote over a network, requiring an attacker to sacrifice a request to the sync_course_run_from_request endpoint to time the response and forge a valid HMAC. This allows unauthorized access to protected resources or actions within the LMS. The likelihood of exploitation is low according to current metrics, but the impact of bypassing authentication warrants timely resolution.