CVE-2026-53636: Open edX LTI OAuth Replay Attack
Open edX Platform enables the authoring and delivery of online learning at any scale. Prior to commit 3a5ac85, a security vulnerability has been identified in the Open edX LMS platform's LTI (Learning Tools Interoperability) Provider implementation. The validatetimestampandnonce function in lms/djangoapps/ltiprovider/signaturevalidator.py does not validate OAuth nonces or timestamps, allowing an attacker who captures a valid LTI launch request to replay it an unlimited number of times without detection. This issue has been patched via commit 3a5ac85.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Open edX LMS (LTI Provider)to a version that resolves this vulnerability.Patch 3a5ac85
Event History
Frequently Asked Questions
Which deployments are exposed?
Open edX LMS deployments using the LTI Provider implementation are affected if they are based on code from before commit 3a5ac85.
What does an attacker need to exploit this issue?
An attacker must capture a valid LTI launch request. They can then replay that request repeatedly because the affected validation function does not validate OAuth nonces or timestamps.
What fixes the issue?
Update to code that includes commit 3a5ac85, which patches the nonce and timestamp validation issue.