Description
Open edX Platform enables the authoring and delivery of online learning at any scale. Prior to commit 3a5ac85, a security vulnerability has been identified in the Open edX LMS platform's LTI (Learning Tools Interoperability) Provider implementation. The validate_timestamp_and_nonce function in lms/djangoapps/lti_provider/signature_validator.py does not validate OAuth nonces or timestamps, allowing an attacker who captures a valid LTI launch request to replay it an unlimited number of times without detection. This issue has been patched via commit 3a5ac85.
Published: 2026-09-02
Score: 4.7 Medium
EPSS: < 1% Very Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

Open edX Platform’s LTI provider implementation allows an attacker to capture a valid OAuth‑signed LTI launch and replay it repeatedly because the timestamp and nonce are not validated. Each replay can create duplicate launches or trigger actions repeatedly, potentially flooding a platform or conducting unauthorized accesses. The weakness is a non‑reusable nonce/Timestamp validation failure (CWE‑294).

Affected Systems

Vendors: Open edX; Product: Open edX Platform LMS. Versions up to, but excluding, commit 3a5ac85 are vulnerable. Those running earlier code without the patch are affected.

Risk and Exploitability

The CVSS score of 4.7 indicates moderate severity. EPSS data is not available and the vulnerability is not in CISA KEV. An attacker must first obtain a legitimate signed LTI launch request—either by intercepting traffic, compromising an LTI tool, or obtaining credentials—then replay it. Once the request is captured, replay is unlimited and undetectable without additional logging or nonce validation.

Generated by OpenCVE AI on September 3, 2026 at 10:03 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Apply commit 3a5ac85 or later to the Open edX Platform LMS
  • Verify that the lms/djangoapps/lti_provider/signature_validator.py validate_timestamp_and_nonce function is enabled and correctly configured
  • Review platform logs for repeated LTI launch events and adjust monitoring rules to alert on suspicious replay patterns

Generated by OpenCVE AI on September 3, 2026 at 10:03 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Thu, 03 Sep 2026 15:45:00 +0000

Type Values Removed Values Added
First Time appeared Openedx
Openedx edx-platform
Vendors & Products Openedx
Openedx edx-platform

Wed, 02 Sep 2026 17:00:00 +0000

Type Values Removed Values Added
Description Open edX Platform enables the authoring and delivery of online learning at any scale. Prior to commit 3a5ac85, a security vulnerability has been identified in the Open edX LMS platform's LTI (Learning Tools Interoperability) Provider implementation. The validate_timestamp_and_nonce function in lms/djangoapps/lti_provider/signature_validator.py does not validate OAuth nonces or timestamps, allowing an attacker who captures a valid LTI launch request to replay it an unlimited number of times without detection. This issue has been patched via commit 3a5ac85.
Title Open edX LTI OAuth Replay Attack
Weaknesses CWE-294
References
Metrics cvssV3_1

{'score': 4.7, 'vector': 'CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:N'}

Subscriptions

Openedx Edx-platform
cve-icon MITRE

Status: PUBLISHED

Assigner: GitHub_M

Published:

Updated: 2026-09-02T18:03:41.926Z

Reserved: 2026-06-09T20:16:59.647Z

Link: CVE-2026-53636

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Received

Published: 2026-09-02T17:17:45.917

Modified: 2026-09-02T19:17:21.457

Link: CVE-2026-53636

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-09-03T15:30:05Z

Weaknesses
  • CWE-294

    Authentication Bypass by Capture-replay