The RELATE courseware package contained a timing attack vulnerability (CWE-208) in the check_sign_in_key() function of course/auth.py. This vulnerability allowed attackers to exploit observable timing differences to potentially gain sensitive information. The issue was fixed in commit 2f68e16. The vulnerability has a CVSS v3.1 score of 9.0, reflecting its critical nature with network attack vector, high attack complexity, no privileges required, no user interaction, and complete impact on confidentiality, integrity, and availability.

Successful exploitation of this timing attack vulnerability could lead to disclosure of sensitive authentication information, potentially allowing attackers to bypass authentication mechanisms. The vulnerability impacts confidentiality, integrity, and availability of the affected system. There are no known exploits in the wild as of the published date.

This vulnerability has been patched in commit 2f68e16 of the RELATE project. Users and administrators should update to this commit or a later version to remediate the issue. Since this is not a cloud service, remediation requires applying the patch to affected installations. Patch status is confirmed by the vendor commit reference.