A timing side‑channel in the course/auth.py function check_sign_in_key() enables an attacker to infer the correct sign‑in key by measuring response times. Based on the description, it is inferred that an attacker could use this information to bypass authentication and gain unauthorized access to protected courseware resources. The weakness is identified as both CWE‑203, which describes information exposure through timing, and CWE‑208, a timing channel that can leak sensitive information.

The vulnerability exists in the RELATE web‑based courseware product from inducer. All released versions prior to commit 2f68e16 are affected, regardless of release number, since the timing leak was present in every code base until that patch was applied.

The CVSS score of 9.0 classifies this incident as a critical flaw. Based on the description, an attacker could exploit the timing side‑channel by issuing web‑based requests to the sign‑in endpoint and measuring response times to deduce the correct key. The EPSS score indicates a probability of exploitation of less than 1%, implying that while the likelihood is low, it is not zero and could still be relevant for high‑value targets. The flaw is not listed in CISA KEV.