PolarLearn présente de multiples CSRF de connexion via l'absence de paramètre OAuth state (GitHub & Google)

An attacker can exploit this CSRF vulnerability to trick a legitimate user into unknowingly performing actions on their behalf within PolarLearn. Specifically, the attacker can pre-authenticate a session using the victim's GitHub or Google account. Any data the victim subsequently enters, such as academic progress or personal information, will be stored on the attacker's account, leading to data loss for the victim. Furthermore, the attacker gains access to information associated with the victim's account, resulting in information disclosure. This vulnerability highlights the importance of proper state parameter validation in OAuth 2.0 flows.

Educational institutions and individuals using PolarLearn for online learning are at risk. Specifically, users who rely on GitHub or Google for authentication are particularly vulnerable. Those using older, unpatched versions of PolarLearn are most susceptible to exploitation.

1. 2026-02-02Disclosure

   disclosure

1. Réservé2026-01-30
2. Publiée2026-02-02
3. Modifiée2026-02-03
4. EPSS mis à jour2026-03-23

The primary mitigation for CVE-2026-25221 is to immediately upgrade PolarLearn to version 0.0.1 or later, which contains the fix for this CSRF vulnerability. If upgrading is not immediately feasible, consider implementing a Content Security Policy (CSP) to restrict the sources from which PolarLearn can load resources. Additionally, educate users about the risks of clicking on suspicious links or visiting untrusted websites while logged into PolarLearn. While a WAF may offer some protection, it is not a substitute for patching the application.