What’s Vulnerable › Vulnerabilities

CVE-2026-25222: PolarLearn Affected by User Enumeration via Argon2 Timing Attack on Sign-In Endpoint

• Severity: high (CVSS 7.5 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.5% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2026-02-02 · updated 2026-06-17
• Weakness: CWE-200

Description

PolarLearn is a free and open-source learning program. In 0-PRERELEASE-15 and earlier, a timing attack vulnerability in the sign-in process allows unauthenticated attackers to determine if a specific email address is registered on the platform. By measuring the response time of the login endpoint, an attacker can distinguish between valid and invalid email addresses. This occurs because the server only performs the computationally expensive Argon2 password hashing if the user exists in the database. Requests for existing users take significantly longer (~650ms) than requests for non-existent users (~160ms).

Affected products

• polarnl PolarLearn: all versions

References

• https://github.com/polarnl/PolarLearn/commit/6c276855172c7310cce0df996cb47ffe0d886741
• https://github.com/polarnl/PolarLearn/security/advisories/GHSA-wcr9-mvr9-4qh5

Get alerted when CVE-2026-25222 or the next vulnerability affects your stack