PT-2026-5730 · Unknown · Polarlearn

Jvr2022 · Published 2026-02-02 · Updated 2026-02-02 · CVE-2026-25222

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions PolarLearn versions 0-PRERELEASE-15 and earlier

Description A timing attack in the sign-in process allows unauthenticated attackers to determine if a specific email address is registered on the platform. The vulnerability occurs because the server performs Argon2 password hashing only if the user exists in the database. Requests for existing users take approximately 650ms, while requests for non-existent users take approximately 160ms. By measuring the response time of the login endpoint, an attacker can distinguish between valid and invalid email addresses. The vulnerable API endpoint is the login endpoint. The email address is the vulnerable parameter.

Recommendations Apply a fix to ensure consistent response times for both valid and invalid email addresses during the sign-in process.

Exploit

Fix

Information Disclosure

Weakness Enumeration

CWE-200

Related Identifiers

CVE-2026-25222

GHSA-WCR9-MVR9-4QH5

Affected Products

Polarlearn

References · 7

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/25xxx/CVE-2026-25222.json · Exploit
• https://github.com/polarnl/PolarLearn/security/advisories/GHSA-wcr9-mvr9-4qh5 · Vendor Advisory
• https://github.com/polarnl/PolarLearn/commit/6c276855172c7310cce0df996cb47ffe0d886741 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2026-25222 · Security Note
• https://osv.dev/vulnerability/CVE-2026-25222 · Vendor Advisory
• https://twitter.com/VulmonFeeds/status/2018471492875432323 · Twitter Post
• https://twitter.com/CVEnew/status/2018465499227586917 · Twitter Post