Technical impact
The vulnerability arises from deterministic token generation in the make_sign_in_key() function of auth.py and the gen_ticket_code() function of exam.py, allowing an attacker to predict or recreate authentication tokens and exam tickets. This flaw enables unauthorized sign‑in and access to user exam data, effectively bypassing authentication and potentially exposing confidential educational content. The weakness is classified under CWE‑330 and CWE‑338, indicating the use of non‑secret or inadequately random token values.
Affected Systems
All versions of inducer:relate released before the commit 2f68e16. After that commit, the bug is patched; version updates or patch application are strongly recommended.
Risk and Exploitability
The CVSS score of 8.7 denotes high severity with potential for remote exploitation. Although EPSS data is not available, the public disclosure and patch commit suggest that the exploit is known and could be readily leveraged. The vulnerability is not listed in CISA KEV, but its high CVSS and the nature of the token predictability imply a significant likelihood of compromise if left unpatched. The likely attack vector involves the web interface; an attacker could submit crafted requests that trigger token generation, requiring no special credentials and yielding immediate access or exam manipulation.
