Description

Open edX Platform enables the authoring and delivery of online learning at any scale. Prior to commit 3a5ac85, a security vulnerability has been identified in the Open edX LMS platform's LTI (Learning Tools Interoperability) Provider implementation. The validate_timestamp_and_nonce function in lms/djangoapps/lti_provider/signature_validator.py does not validate OAuth nonces or timestamps, allowing an attacker who captures a valid LTI launch request to replay it an unlimited number of times without detection. This issue has been patched via commit 3a5ac85.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "4.7",
  "pubDate": "2026-09-02T17:17:45.917Z",
  "pubdate": "2026-09-02T17:17:45.917Z",
  "executiveSummary": "The Open edX LMS platform contains a critical security vulnerability within its LTI (Learning Tools Interoperability) Provider implementation, specifically regarding the handling of OAuth security parameters.\nThe vulnerability is classified as an improper replay attack protection mechanism. Due to a failure in validating nonces and timestamps during the LTI launch process, the system is susceptible to replay attacks.\nAn attacker who successfully intercepts a valid LTI launch request can repeatedly resubmit this request to the LMS. Since the system does not verify the uniqueness of the nonce or the freshness of the timestamp, the replayed requests are treated as legitimate by the platform.\nThis flaw allows unauthorized access, potentially leading to identity spoofing or unauthorized actions within the scope of the captured LTI launch session.\nThe vulnerability affects versions prior to commit 3a5ac85. Remediation requires an immediate update to a patched version of the Open edX Platform to ensure that the signature_validator.py logic correctly enforces OAuth security constraints.",
  "technicalDetails": "The vulnerability originates in the validate_timestamp_and_nonce function located within lms/djangoapps/lti_provider/signature_validator.py. This component is responsible for verifying the integrity and security of incoming LTI launch requests.\nThe root cause of this vulnerability is the omission of cryptographic nonce verification and timestamp validation within the aforementioned function. In the context of OAuth-based LTI launches, the nonce serves as a unique identifier for each request, and the timestamp ensures the request is recent, preventing intercepted requests from being used after an initial transmission.\nBy failing to track or validate these parameters, the Open edX LMS loses the ability to distinguish between an original, authorized LTI launch and an identical copy submitted by an adversary.\nThe attack flow proceeds as follows: 1) An attacker monitors network traffic or inspects logs where valid LTI launch requests are processed; 2) The attacker intercepts a legitimate LTI request, which includes valid OAuth parameters (signature, timestamp, nonce, etc.); 3) The attacker replays the captured request to the Open edX LMS endpoint; 4) The server processes the request, bypassing the validation step that should have identified the reused nonce or expired timestamp; 5) The LMS authenticates the request as if it were a new, legitimate launch.\nThis behavior allows the attacker to achieve post-exploitation impacts such as gaining unauthorized access to the user context associated with the original LTI launch, potentially performing actions or accessing data that should have been restricted to the legitimate user session.\nThe issue persists in all Open edX Platform versions preceding commit 3a5ac85. The lack of validation creates a persistent window for replay attacks, as there is no state tracking implemented to expire nonces or enforce a strict time-to-live for authentication tokens in this specific module.\nThe vulnerability does not require prior authentication to the LMS itself to trigger the replay, as the LTI launch is often the entry point for authentication or session establishment, making the LTI provider interface the primary attack surface exposed over the network."
}