CVE-2026-25221

Katalog CVE

CVSS 8.1 · High EPSS 0,24%

Kerentanan Cross-Site Request Forgery (CSRF) pada polarlearn. Skor CVSS 3.1 8.1 (High) menurut NVD.

Deskripsi (NVD)

PolarLearn is a free and open-source learning program. In 0-PRERELEASE-15 and earlier, the OAuth 2.0 implementation for GitHub and Google login providers is vulnerable to Login Cross-Site Request Forgery (CSRF). The application fails to implement and verify the state parameter during the authentication flow. This allows an attacker to pre-authenticate a session and trick a victim into logging into the attacker's account. Any data the victim then enters or academic progress they make is stored on the attacker's account, leading to data loss for the victim and information disclosure to the attacker.

Rincian

Terbit di NVD

2 Februari 2026

Terakhir diubah

17 Juni 2026

Status NVD

Analyzed

CVSS 3.1

8.1 (High), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-352: Cross-Site Request Forgery (CSRF)

EPSS (30 hari)

0,24% peluang dieksploitasi; lebih tinggi dari 13,2% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/polarnl/PolarLearn/security/advisories/GHSA-fhhm-574m-7rpw exploit · advisory vendor
• https://github.com/polarnl/PolarLearn/commit/44669bbb5b647c7625f22dd82f3121c7d7bfbe19 patch