Executive Summary

This vulnerability affects the OAuth 2.0 implementation in PolarLearn for GitHub and Google login providers. The application does not implement or verify the state parameter during authentication, which makes it vulnerable to Login Cross-Site Request Forgery (CSRF). An attacker can pre-authenticate a session and trick a victim into logging into the attacker's account. As a result, any data the victim enters or academic progress they make is stored on the attacker's account.

Useful 0 Not Useful 0

Impact Analysis

The vulnerability can lead to data loss for the victim and information disclosure to the attacker. Specifically, because the victim is tricked into logging into the attacker's account, any data or academic progress the victim inputs is stored under the attacker's account, potentially causing loss of personal data and unauthorized access to sensitive information.

Useful 0 Not Useful 0