Signal is active with 1 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
PolarLearn is a free and open-source learning program. In 0-PRERELEASE-15 and earlier, the OAuth 2.0 implementation for GitHub and Google login providers is vulnerable to Login Cross-Site Request Forgery (CSRF). The application fails to implement and verify the state parameter during the authentication flow. This allows an attacker to pre-authenticate a session and trick a victim into logging into the attacker's account. Any data the victim then enters or academic progress they make is stored on the attacker's account, leading to data loss for the victim and information disclosure to the attacker.
Priority
LOW
Exploitation
NONE
PoC
YES
Patch
AVAILABLE
Momentum
STABLE
If you run products in this scope, you should treat this CVE as relevant to your environment.
1 version affected across 1 product
| Date | Total | Labels |
|---|
| 2026-02-02 | 2 | Disclosure2 |
| 2026-03-02 | 1 | General1 |
📌 Top CVEs recientes (CVSS>=7.0): 1. 🛡️ CVE-2026-25221 (CVSS: 8.1) 2. ⚠️ CVE-2026-25134 (CVSS: 8.8) 3. ⚠️ CVE-2026-23515 (CVSS: 9.9) 4. 🕷️ CVE-2025-13096 (CVSS: 7.1) 5. ⚠️ CVE-2026-22229 (CVSS: 7.2) #CyberSecurity #CVE #Infosec
Post summary
A brief list of recent high‑CVSS CVEs without additional context or actionable details.
CVE-2026-25221 Login Cross-Site Request Forgery Vulnerability in PolarLearn 0-PRERELEASE-15 OAuth Implementation https://vulmon.com/vulnerabilitydetails?qid=CVE-2026-25221
Post summary
A Cross‑Site Request Forgery vulnerability (CVE‑2026‑25221) affecting the PolarLearn OAuth implementation has been identified. No exploit, PoC, or patch details are provided in this brief report.
CVE-2026-25221 PolarLearn is a free and open-source learning program. In 0-PRERELEASE-15 and earlier, the OAuth 2.0 implementation for GitHub and Google login providers is vulnerabl… https://www.cve.org/CVERecord?id=CVE-2026-25221
Post summary
A new CVE (CVE-2026-25221) affecting OAuth 2.0 in PolarLearn's login implementation has been disclosed; no proof of concept, exploit, patch, or active exploitation is reported.
1 of 1 entries
| Part | Vendor | Product | Version | Target SW | Target HW |
|---|---|---|---|---|---|
| App | polarlearn | polarlearn | - | - | - |