CVE-2026-25221
Login CSRF in PolarLearn OAuth Allows Account Takeover
Publication date: 2026-02-02
Last updated on: 2026-02-20
Assigner: GitHub, Inc.
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| polarlearn | polarlearn | * |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-352 | The web application does not, or cannot, sufficiently verify whether a request was intentionally provided by the user who sent the request, which could have originated from an unauthorized actor. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability affects the OAuth 2.0 implementation in PolarLearn for GitHub and Google login providers. The application does not implement or verify the state parameter during authentication, which makes it vulnerable to Login Cross-Site Request Forgery (CSRF). An attacker can pre-authenticate a session and trick a victim into logging into the attacker's account. As a result, any data the victim enters or academic progress they make is stored on the attacker's account.
How can this vulnerability impact me? :
The vulnerability can lead to data loss for the victim and information disclosure to the attacker. Specifically, because the victim is tricked into logging into the attacker's account, any data or academic progress the victim inputs is stored under the attacker's account, potentially causing loss of personal data and unauthorized access to sensitive information.