Is CVE-2026-53636 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-53636 being exploited in the wild.

How severe is CVE-2026-53636?

Medium severity, with a CVSS score of 4.7, published 2 September 2026.

Which products and versions are affected?

Open edX Platform Prior to commit 3a5ac85.

Is there a fix for CVE-2026-53636?

A patch was published on 2026-09-02: Patch applied via commit 3a5ac85 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-53636 attacked?

It is attacked over the network.

Am I affected by CVE-2026-53636?

Check whether you run Open edX Platform at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-53636: Open edX Platform LTI replay attack in nonce validation

CVE-2026-53636 · Severity: medium · CVSS 4.7 · Published 2026-09-02

Open edX is an online learning platform used by educational institutions to deliver and manage courses at scale. A vulnerability in its LTI (Learning Tools Interoperability) integration allows attackers to replay captured learning tool launch requests repeatedly, potentially granting unauthorized access to course content or allowing impersonation of legitimate users without the ability to detect the attack.

Technologies: Open edX Platform. Vendors: Open edX.

Quick answers

Is CVE-2026-53636 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-53636 being exploited in the wild.
How severe is CVE-2026-53636?: Medium severity, with a CVSS score of 4.7, published 2 September 2026.
Which products and versions are affected?: Open edX Platform Prior to commit 3a5ac85.
Is there a fix for CVE-2026-53636?: A patch was published on 2026-09-02: Patch applied via commit 3a5ac85 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-53636 attacked?: It is attacked over the network.
Am I affected by CVE-2026-53636?: Check whether you run Open edX Platform at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The vulnerability exists in the validate_timestamp_and_nonce function within lms/djangoapps/lti_provider/signature_validator.py, which fails to properly validate OAuth nonces and timestamps. This is a replay attack vulnerability (CWE-115/CWE-613) in the LTI Provider implementation. An attacker who intercepts a valid LTI launch request can replay it multiple times without detection or restriction. The attack requires network access to capture an LTI launch request but does not require authentication as the attacker reuses a legitimately captured request. The vulnerability has been patched in commit 3a5ac85, which implements OAuth nonce replay protection.

Affected products

Open edX Open edX Platform Prior to commit 3a5ac85

Timeline

2026-09-02: disclosed
2026-09-02: patched: Patch applied via commit 3a5ac85

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.