Skip to content
OpenAdvisories

Vendor

oppia

2 known vulnerabilities.

Products

oppia 2
All Critical High Medium Low Exploited only Public exploit

2 results · Clear filters · Feed

  • Medium 4.3
    CVE-2026-85210

    Oppia through 3.5.2 Missing Authorization on AdminRoleHandler GET

    Oppia's AdminRoleHandler GET endpoint in core/controllers/admin.py is decorated with open_access, allowing any registered user to enumerate privileged accounts and roles. Attackers can query the endpoint with filter_criterion parameters to retrieve usernames …

    oppia oppia
  • Medium 5.3
    CVE-2023-40021

    Timing Attack Reveals CSRF Tokens in oppia

    Oppia is an online learning platform. When comparing a received CSRF token against the expected token, Oppia uses the string equality operator (`==`), which is not safe against timing attacks. By repeatedly submitting invalid tokens, an attacker can brute-for…

    oppia oppia