Timing Attack Vulnerability in PolarLearn Learning Program

CVE-2026-25222

What is CVE-2026-25222?

PolarLearn, a free and open-source learning platform, has a vulnerability in its sign-in process that exposes registered email addresses. Attackers can exploit this timing attack by measuring the response time of login attempts to differentiate between valid and invalid email addresses. The server engages in a resource-intensive Argon2 password hashing operation only if a user account exists, thus revealing telltale delays in processing requests for valid accounts. This issue primarily affects PolarLearn versions up to 0-PRERELEASE-15, allowing unauthorized users to verify the presence of an email address within the system.

References