Signal is active with 2 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
PolarLearn is a free and open-source learning program. In 0-PRERELEASE-15 and earlier, a timing attack vulnerability in the sign-in process allows unauthenticated attackers to determine if a specific email address is registered on the platform. By measuring the response time of the login endpoint, an attacker can distinguish between valid and invalid email addresses. This occurs because the server only performs the computationally expensive Argon2 password hashing if the user exists in the database. Requests for existing users take significantly longer (~650ms) than requests for non-existent users (~160ms).
Priority
LOW
Exploitation
NONE
PoC
YES
Patch
AVAILABLE
Momentum
NONE
If you run products in this scope, you should treat this CVE as relevant to your environment.
1 version affected across 1 product
CVE-2026-25222 Timing Attack Vulnerability in PolarLearn Sign-In Process Reveals User Existence https://vulmon.com/vulnerabilitydetails?qid=CVE-2026-25222
Post summary
A timing attack vulnerability in PolarLearn’s sign‑in process allows attackers to determine the existence of user accounts. This is a newly disclosed weakness with no evidence of exploitation or mitigation yet.
CVE-2026-25222 PolarLearn is a free and open-source learning program. In 0-PRERELEASE-15 and earlier, a timing attack vulnerability in the sign-in process allows unauthenticated att… https://www.cve.org/CVERecord?id=CVE-2026-25222
Post summary
The message announces a timing‑attack vulnerability in PolarLearn’s sign‑in process, but it does not provide an exploit, patch, or evidence of active use.
1 of 1 entries
| Part | Vendor | Product | Version | Target SW | Target HW |
|---|---|---|---|---|---|
| App | polarlearn | polarlearn | - | - | - |