PolarLearn is a free and open-source learning program. In 0-PRERELEASE-15 and earlier, a timing attack vulnerability in the sign-in process allows unauthenticated attackers to determine if a specific email address is registered on the platform. By measuring the response time of the login endpoint, an attacker can distinguish between valid and invalid email addresses. This occurs because the server only performs the computationally expensive Argon2 password hashing if the user exists in the database. Requests for existing users take significantly longer (~650ms) than requests for non-existent users (~160ms).
Metrics
Affected Vendors & Products
No data.
No data.
No data.
No data.
References
History
Mon, 02 Feb 2026 23:15:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| Description | PolarLearn is a free and open-source learning program. In 0-PRERELEASE-15 and earlier, a timing attack vulnerability in the sign-in process allows unauthenticated attackers to determine if a specific email address is registered on the platform. By measuring the response time of the login endpoint, an attacker can distinguish between valid and invalid email addresses. This occurs because the server only performs the computationally expensive Argon2 password hashing if the user exists in the database. Requests for existing users take significantly longer (~650ms) than requests for non-existent users (~160ms). | |
| Title | PolarLearn Affected by User Enumeration via Argon2 Timing Attack on Sign-In Endpoint | |
| Weaknesses | CWE-200 | |
| References |
| |
| Metrics |
cvssV4_0
|
MITRE
Status: PUBLISHED
Assigner: GitHub_M
Published:
Updated: 2026-02-02T23:01:02.519Z
Reserved: 2026-01-30T14:44:47.327Z
Link: CVE-2026-25222
Vulnrichment
No data.
NVD
Status : Received
Published: 2026-02-02T23:16:09.923
Modified: 2026-02-02T23:16:09.923
Link: CVE-2026-25222
Redhat
No data.
OpenCVE Enrichment
No data.