CVE-2026-39322: Authentication Bypass in PolarLearn

An attacker exploiting this vulnerability can bypass the intended restrictions placed on banned user accounts. By crafting a specific POST request to the /api/v1/auth/sign-in endpoint, an attacker can create a valid session even if the account is flagged as banned. This session is then accepted across authenticated API routes, effectively allowing the attacker to impersonate the banned user. The potential impact includes unauthorized access to account data, modification of learning materials, and potentially even administrative actions depending on the permissions associated with the banned account. This could compromise the integrity and confidentiality of the learning platform.

1. Reserved2026-04-06
2. Published2026-04-07
3. Modified2026-04-09
4. EPSS updated2026-04-15

The primary mitigation for CVE-2026-39322 is to upgrade PolarLearn to version 0.0.2 or later, which contains the fix for this authentication bypass. If upgrading is not immediately feasible, consider implementing temporary workarounds such as stricter input validation on the /api/v1/auth/sign-in endpoint to prevent the creation of sessions for banned accounts. Review and enhance existing ban enforcement mechanisms to ensure they are correctly preventing access to authenticated routes. Monitor API logs for suspicious login attempts or unusual activity associated with banned accounts.