Information disclosure in Polarlearn
CVE-2026-25222
PolarLearn is a free and open-source learning program. In 0-PRERELEASE-15 and earlier, a timing attack vulnerability in the sign-in process allows unauthenticated attackers to determine if a specific email address is registered on the platform. By measuring the response time of the login endpoint, an attacker can distinguish between valid and invalid email addresses. This occurs because the server only performs the computationally expensive Argon2 password hashing if the user exists in the database. Requests for existing users take significantly longer (~650ms) than requests for non-existent users (~160ms).
Vulnerability class: Information Disclosure
Published · last modified .
CVSS v3 metric
CVSS v3 base score 7.5 (High). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N.
EPSS exploit prediction
EPSS: 0.005 (38.1th percentile), scored .
Very low probability of exploitation in the next 30 days; routine patching cadence is appropriate. 38th percentile — 38.1% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.
EPSS over last 30 days · oldest: 0.004 · newest: 0.005 · change: +0.000
Affected products
- Polarlearn
- Polarnl Polarlearn — versions <= 0-PRERELEASE-15
Weakness classification (CWE)
References
Frequently asked questions
- What is CVE-2026-25222?
- CVE-2026-25222 is a high-severity vulnerability in Polarlearn, classified under Information Disclosure. CVSS score: 7.5/10. Published 2026-02-02.
- How severe is CVE-2026-25222?
- High severity. CVSS v3 base score is 7.5 out of 10.