# CVE-2026-41588: inducer RELATE timing attack in check_sign_in_key

Source: https://junglewise.ai/threats/cve-2026-41588-inducer-relate-timing-attack-in-check-sign-in-key  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-05-08. Updated: 2026-05-14  
License: CC BY 4.0 with a link back

CVE-2026-41588 · Severity: critical · CVSS 9 · Published 2026-05-08

RELATE is a web-based courseware platform used for managing educational content and student assessments. A security flaw in the login system allows attackers to potentially guess secret sign-in tokens by measuring tiny differences in how long the server takes to respond to login attempts. If successful, an attacker could gain unauthorized access to user accounts, potentially compromising student data or course materials.

Technologies: [Inducer Relate](https://junglewise.ai/threats/technologies/relate). Vendors: [Inducer](https://junglewise.ai/threats/vendors/inducer).

## Quick answers

**Is CVE-2026-41588 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-41588 being exploited in the wild.

**How severe is CVE-2026-41588?** Critical severity, with a CVSS score of 9, published 8 May 2026.

**Which products and versions are affected?** Inducer Relate <=2024.1.

**Is there a fix for CVE-2026-41588?** A patch was published on 2026-04-17: Fixed in commit 2f68e16cd3b96d25c188c1aa3f7e13cdb15cdaeb Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-41588 attacked?** It is attacked over the network, in a web application.

**Am I affected by CVE-2026-41588?** Check whether you run Inducer Relate at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A timing attack vulnerability exists in RELATE's authentication mechanism within `course/auth.py` and `EmailedTokenBackend.authenticate()`. The root cause is the use of Python's standard `==` operator for comparing `sign_in_key` tokens, which performs non-constant-time string comparison. Because the comparison returns early upon finding a mismatched character, a remote, unauthenticated attacker can measure response time discrepancies to leak valid tokens byte-by-byte. This allows for full authentication bypass. The vulnerability has been remediated in commit 2f68e16 by implementing `hmac.compare_digest()` for constant-time comparison.

## Affected products

- inducer RELATE <=2024.1

## Timeline

- 2026-04-17: patched: Fixed in commit 2f68e16cd3b96d25c188c1aa3f7e13cdb15cdaeb
- 2026-05-08: disclosed
- 2026-05-08: advisory

## References

- [https://github.com/inducer/relate/commit/2f68e16cd3b96d25c188c1aa3f7e13cdb15cdaeb](https://github.com/inducer/relate/commit/2f68e16cd3b96d25c188c1aa3f7e13cdb15cdaeb)
- [https://github.com/inducer/relate/security/advisories/GHSA-78j7-9xr9-2728](https://github.com/inducer/relate/security/advisories/GHSA-78j7-9xr9-2728)

## Related threats

- [RELATE LMS insecure pickle deserialization in Celery workers](https://junglewise.ai/threats/cve-2026-47161-relate-lms-insecure-pickle-deserialization-in-celery-workers)
- [inducer RELATE stored XSS in ParticipationAdmin](https://junglewise.ai/threats/cve-2026-42197-inducer-relate-stored-xss-in-participationadmin)