Cross-Site Request Forgery in PolarLearn OAuth 2.0 Implementation by Polar

CVE-2026-25221

What is CVE-2026-25221?

PolarLearn, an open-source learning program, faces a significant security risk due to its improper handling of the OAuth 2.0 protocol, particularly with GitHub and Google login providers. In versions 0-PRERELEASE-15 and earlier, the application does not effectively implement or verify the state parameter during the authentication process. This shortcoming allows malicious actors to exploit the vulnerability, potentially pre-authenticating a victim's session and redirecting them to an attacker's account. Consequently, any data input by the victim, including academic progress, is redirected to the attacker’s account, resulting in potential data loss for the victim and unauthorized access to sensitive information.

References