A timing side‑channel in the course/auth.py function check_sign_in_key() enables an attacker to infer the correct sign‑in key by measuring response times. Based on the description, it is inferred that an attacker could use this information to bypass authentication and gain unauthorized access to protected courseware resources. The weakness is identified as CWE‑208, a timing channel that can leak sensitive information.

The vulnerability exists in the RELATE web‑based courseware product from inducer. All released versions prior to commit 2f68e16 are affected, regardless of release number, since the timing leak was present in every code base until that patch was applied.

The CVSS score of 9.0 classifies this incident as a critical flaw. Based on the description, it is inferred that an attacker could exploit the timing side‑channel by issuing web‑based requests to the sign‑in endpoint and measuring response times to deduce the correct key. Because EPSS data is not available, the precise likelihood of exploitation cannot be quantified, but the high severity and the nature of the attack suggest that the vulnerability could be abused in realistic settings, especially over the public Internet. The flaw is not listed in the CISA KEV catalog.