Login CSRF in PolarLearn OAuth Allows Account Takeover

Publication date: 2026-02-02

Last updated on: 2026-02-20

Assigner: GitHub, Inc.

Description

PolarLearn is a free and open-source learning program. In 0-PRERELEASE-15 and earlier, the OAuth 2.0 implementation for GitHub and Google login providers is vulnerable to Login Cross-Site Request Forgery (CSRF). The application fails to implement and verify the state parameter during the authentication flow. This allows an attacker to pre-authenticate a session and trick a victim into logging into the attacker's account. Any data the victim then enters or academic progress they make is stored on the attacker's account, leading to data loss for the victim and information disclosure to the attacker.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-02-02

Last Modified

2026-02-20

Generated

2026-07-07

AI Q&A

2026-02-03

EPSS Evaluated

2026-07-05

NVD

CVE-2026-25221

Affected Vendors & Products

Vendor	Product	Version / Range
polarlearn	polarlearn	*

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-352	The web application does not, or cannot, sufficiently verify whether a request was intentionally provided by the user who sent the request, which could have originated from an unauthorized actor.

Attack-Flow Graph

Executive Summary

This vulnerability affects the OAuth 2.0 implementation in PolarLearn for GitHub and Google login providers. The application does not implement or verify the state parameter during authentication, which makes it vulnerable to Login Cross-Site Request Forgery (CSRF). An attacker can pre-authenticate a session and trick a victim into logging into the attacker's account. As a result, any data the victim enters or academic progress they make is stored on the attacker's account.

Impact Analysis

The vulnerability can lead to data loss for the victim and information disclosure to the attacker. Specifically, because the victim is tricked into logging into the attacker's account, any data or academic progress the victim inputs is stored under the attacker's account, potentially causing loss of personal data and unauthorized access to sensitive information.

Hi! I’m here to help you understand CVE-2026-25221. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70