CVE-2026-25221

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-25221", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2026-01-30T14:44:47.327Z", "datePublished": "2026-02-02T22:59:38.569Z", "dateUpdated": "2026-02-03T19:52:26.258Z"}, "containers": {"cna": {"title": "PolarLearn has Multiple Login CSRFs via Missing OAuth state Parameter (GitHub & Google)", "problemTypes": [{"descriptions": [{"cweId": "CWE-352", "lang": "en", "description": "CWE-352: Cross-Site Request Forgery (CSRF)", "type": "CWE"}]}], "metrics": [{"cvssV4_0": {"attackVector": "NETWORK", "attackComplexity": "LOW", "attackRequirements": "PRESENT", "privilegesRequired": "NONE", "userInteraction": "PASSIVE", "vulnConfidentialityImpact": "NONE", "vulnIntegrityImpact": "LOW", "vulnAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "LOW", "subAvailabilityImpact": "NONE", "baseScore": 2.3, "baseSeverity": "LOW", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:N/VI:L/VA:N/SC:N/SI:L/SA:N", "version": "4.0"}}], "references": [{"name": "https://github.com/polarnl/PolarLearn/security/advisories/GHSA-fhhm-574m-7rpw", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/polarnl/PolarLearn/security/advisories/GHSA-fhhm-574m-7rpw"}, {"name": "https://github.com/polarnl/PolarLearn/commit/44669bbb5b647c7625f22dd82f3121c7d7bfbe19", "tags": ["x_refsource_MISC"], "url": "https://github.com/polarnl/PolarLearn/commit/44669bbb5b647c7625f22dd82f3121c7d7bfbe19"}], "affected": [{"vendor": "polarnl", "product": "PolarLearn", "versions": [{"version": "<= v0-PRERELEASE-15", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-02-02T22:59:38.569Z"}, "descriptions": [{"lang": "en", "value": "PolarLearn is a free and open-source learning program. In 0-PRERELEASE-15 and earlier, the OAuth 2.0 implementation for GitHub and Google login providers is vulnerable to Login Cross-Site Request Forgery (CSRF). The application fails to implement and verify the state parameter during the authentication flow. This allows an attacker to pre-authenticate a session and trick a victim into logging into the attacker's account. Any data the victim then enters or academic progress they make is stored on the attacker's account, leading to data loss for the victim and information disclosure to the attacker."}], "source": {"advisory": "GHSA-fhhm-574m-7rpw", "discovery": "UNKNOWN"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-02-03T19:52:11.220215Z", "id": "CVE-2026-25221", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-02-03T19:52:26.258Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"cna": {"title": "PolarLearn has Multiple Login CSRFs via Missing OAuth state Parameter (GitHub & Google)", "source": {"advisory": "GHSA-fhhm-574m-7rpw", "discovery": "UNKNOWN"}, "metrics": [{"cvssV4_0": {"version": "4.0", "baseScore": 2.3, "attackVector": "NETWORK", "baseSeverity": "LOW", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:N/VI:L/VA:N/SC:N/SI:L/SA:N", "userInteraction": "PASSIVE", "attackComplexity": "LOW", "attackRequirements": "PRESENT", "privilegesRequired": "NONE", "subIntegrityImpact": "LOW", "vulnIntegrityImpact": "LOW", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "NONE"}}], "affected": [{"vendor": "polarnl", "product": "PolarLearn", "versions": [{"status": "affected", "version": "<= v0-PRERELEASE-15"}]}], "references": [{"url": "https://github.com/polarnl/PolarLearn/security/advisories/GHSA-fhhm-574m-7rpw", "name": "https://github.com/polarnl/PolarLearn/security/advisories/GHSA-fhhm-574m-7rpw", "tags": ["x_refsource_CONFIRM"]}, {"url": "https://github.com/polarnl/PolarLearn/commit/44669bbb5b647c7625f22dd82f3121c7d7bfbe19", "name": "https://github.com/polarnl/PolarLearn/commit/44669bbb5b647c7625f22dd82f3121c7d7bfbe19", "tags": ["x_refsource_MISC"]}], "descriptions": [{"lang": "en", "value": "PolarLearn is a free and open-source learning program. In 0-PRERELEASE-15 and earlier, the OAuth 2.0 implementation for GitHub and Google login providers is vulnerable to Login Cross-Site Request Forgery (CSRF). The application fails to implement and verify the state parameter during the authentication flow. This allows an attacker to pre-authenticate a session and trick a victim into logging into the attacker's account. Any data the victim then enters or academic progress they make is stored on the attacker's account, leading to data loss for the victim and information disclosure to the attacker."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-352", "description": "CWE-352: Cross-Site Request Forgery (CSRF)"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-02-02T22:59:38.569Z"}}, "adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-25221", "role": "CISA Coordinator", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-02-03T19:52:11.220215Z"}}}], "providerMetadata": {"shortName": "CISA-ADP", "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "dateUpdated": "2026-02-03T19:52:22.853Z"}}]}, "cveMetadata": {"cveId": "CVE-2026-25221", "state": "PUBLISHED", "dateUpdated": "2026-02-02T22:59:38.569Z", "dateReserved": "2026-01-30T14:44:47.327Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2026-02-02T22:59:38.569Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"product": "PolarLearn", "vendor": "polarnl", "versions": [{"status": "affected", "version": "<= v0-PRERELEASE-15"}]}], "source": "security-advisories@github.com"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:polarlearn:polarlearn:-:*:*:*:*:*:*:*", "matchCriteriaId": "98DA1036-1EFB-46E7-9C83-425B1C6E6F23", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "PolarLearn is a free and open-source learning program. In 0-PRERELEASE-15 and earlier, the OAuth 2.0 implementation for GitHub and Google login providers is vulnerable to Login Cross-Site Request Forgery (CSRF). The application fails to implement and verify the state parameter during the authentication flow. This allows an attacker to pre-authenticate a session and trick a victim into logging into the attacker's account. Any data the victim then enters or academic progress they make is stored on the attacker's account, leading to data loss for the victim and information disclosure to the attacker."}, {"lang": "es", "value": "PolarLearn es un programa de aprendizaje gratuito y de c\u00f3digo abierto. En 0-PRERELEASE-15 y versiones anteriores, la implementaci\u00f3n de OAuth 2.0 para los proveedores de inicio de sesi\u00f3n de GitHub y Google es vulnerable a la falsificaci\u00f3n de petici\u00f3n en sitios cruzados (CSRF) de inicio de sesi\u00f3n. La aplicaci\u00f3n no implementa ni verifica el par\u00e1metro state durante el flujo de autenticaci\u00f3n. Esto permite a un atacante preautenticar una sesi\u00f3n y enga\u00f1ar a una v\u00edctima para que inicie sesi\u00f3n en la cuenta del atacante. Cualquier dato que la v\u00edctima introduzca o progreso acad\u00e9mico que realice se almacena en la cuenta del atacante, lo que provoca la p\u00e9rdida de datos para la v\u00edctima y la revelaci\u00f3n de informaci\u00f3n al atacante."}], "id": "CVE-2026-25221", "lastModified": "2026-06-17T10:24:19.800", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 8.1, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 5.2, "source": "nvd@nist.gov", "type": "Primary"}], "cvssMetricV40": [{"cvssData": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "PRESENT", "attackVector": "NETWORK", "availabilityRequirement": "NOT_DEFINED", "baseScore": 2.3, "baseSeverity": "LOW", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "NOT_DEFINED", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "NONE", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "LOW", "userInteraction": "PASSIVE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:N/VI:L/VA:N/SC:N/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnAvailabilityImpact": "NONE", "vulnConfidentialityImpact": "NONE", "vulnIntegrityImpact": "LOW", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "source": "security-advisories@github.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-25221", "options": [{"exploitation": "poc"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-02-03T19:52:11.220215Z", "version": "2.0.3"}}]}, "published": "2026-02-02T23:16:09.757", "references": [{"source": "security-advisories@github.com", "tags": ["Patch"], "url": "https://github.com/polarnl/PolarLearn/commit/44669bbb5b647c7625f22dd82f3121c7d7bfbe19"}, {"source": "security-advisories@github.com", "tags": ["Exploit", "Vendor Advisory"], "url": "https://github.com/polarnl/PolarLearn/security/advisories/GHSA-fhhm-574m-7rpw"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-352"}], "source": "security-advisories@github.com", "type": "Secondary"}]}

{}

{"analysis": {"en": {"generated_at": "2026-04-18T00:28:41.246413+00:00", "value": {"mitigation_remediation": ["Upgrade PolarLearn to version 0\u2011PRERELEASE\u201116 or later, which implements state parameter verification for GitHub and Google OAuth. ", "If an upgrade cannot be performed immediately, modify the OAuth configuration to enforce the generation and validation of a state parameter, preventing cross\u2011site request forgery. ", "Educate users to recognize and avoid unsolicited login prompts, and monitor for any unauthorized account activity."], "summary": {"action": "Apply Patch", "impact": "Login Cross-Site Request Forgery leading to data loss and information disclosure"}, "threat_synthesis": {"affected_systems": "The vulnerability affects the PolarLearn application from vendor polarnl, specifically versions 0\u2011PRERELEASE\u201115 and all earlier releases. Versions that include state parameter validation after the commit 44669bbb5b647c7625f22dd82f3121c7d7bfbe19 are not impacted.", "description_and_impact": "PolarLearn can be tricked into using a pre\u2011authenticated session from an attacker when the OAuth 2.0 flow omits the required state parameter. The flaw allows an attacker to have a victim log in as the attacker\u2019s account, after which any content the victim creates or data entered is recorded under the attacker\u2019s profile. As a result, the victim suffers loss of data and the attacker gains unauthorized access to the victim\u2019s information.", "risk_and_exploitability": "With a CVSS score of 2.3 and an EPSS probability of less than 1%, the likelihood of exploitation is low, and the vulnerability is not listed in the CISA KEV catalog. The attack would require an attacker to supply a link that forces a victim\u2019s browser to initiate an OAuth request, relying on the victim to interact with the login flow. The gain is limited to data owned by the victim and the attacker\u2019s account, but the impact on confidentiality and integrity of the victim\u2019s account is significant. Given the low exploit probability and absence of a known public exploit, the risk is considered moderate but should still be mitigated promptly."}}}}, "created": "2026-02-04T12:18:05.119048+00:00", "updated": "2026-04-18T00:30:25.718417+00:00", "vendors": ["polarnl", "polarnl$PRODUCT$polarlearn"]}