What is the CVSS score of CVE-2026-25221?

CVE-2026-25221 has a CVSS 3.1 base score of 8.1 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N. EPSS exploitation probability: 0.0%.

Which versions of Github are affected by CVE-2026-25221?

PolarLearn's OAuth authentication mechanism contains a critical vulnerability that allows attackers to hijack user login sessions through CSRF attacks, potentially compromising user accounts and…. A patch is available.

Is there a public PoC exploit available for CVE-2026-25221?

Yes, a public proof-of-concept exploit is available for CVE-2026-25221. Prioritise patching immediately. EPSS: 0.0%.

How to fix or mitigate CVE-2026-25221?

Within 24 hours: Inventory all PolarLearn deployments and versions in use; notify users of the vulnerability and advise temporary password changes. Within 7 days: Apply the available vendor patch to all PolarLearn instances and validate the update in a test environment first. Within 30 days: Conduct post-patch security testing, review authentication logs for exploitation attempts, and implement additional OAuth security hardening (SameSite cookie attributes, state parameter validation).

Github CVE-2026-25221

HIGH

Cross-Site Request Forgery (CSRF) (CWE-352)

2026-02-02 security-advisories@github.com

Information Disclosure CSRF Github Polarlearn

8.1

CVSS 3.1 · GitHub Advisory

Severity by source

GitHub Advisory PRIMARY

8.1 HIGH

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N

Primary rating from GitHub Advisory · only source for this CVE.

CVSS VectorGitHub Advisory

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

None

Lifecycle Timeline

Analysis Generated

Mar 12, 2026 - 22:01 vuln.today

PoC Detected

Feb 20, 2026 - 20:45 vuln.today

Public exploit code

Patch released

Feb 20, 2026 - 20:45 nvd

Patch available

CVE Published

Feb 02, 2026 - 23:16 nvd

HIGH 8.1

DescriptionGitHub Advisory

PolarLearn is a free and open-source learning program. In 0-PRERELEASE-15 and earlier, the OAuth 2.0 implementation for GitHub and Google login providers is vulnerable to Login Cross-Site Request Forgery (CSRF). The application fails to implement and verify the state parameter during the authentication flow. This allows an attacker to pre-authenticate a session and trick a victim into logging into the attacker's account. Any data the victim then enters or academic progress they make is stored on the attacker's account, leading to data loss for the victim and information disclosure to the attacker.

AnalysisAI

PolarLearn versions 0-PRERELEASE-15 and earlier lack proper state parameter validation in OAuth 2.0 authentication, enabling attackers to conduct login CSRF attacks against GitHub and Google login flows. An attacker can pre-authenticate a victim's session and trick them into logging into the attacker's account, causing the victim's data and academic progress to be stored on the attacker's account instead. Public exploit code exists for this vulnerability, and a patch is available.

Technical ContextAI

Classified as CWE-352 (Cross-Site Request Forgery (CSRF)). Affects Polarlearn. PolarLearn is a free and open-source learning program. In 0-PRERELEASE-15 and earlier, the OAuth 2.0 implementation for GitHub and Google login providers is vulnerable to Login Cross-Site Request Forgery (CSRF). The application fails to implement and verify the state parameter during the authentication flow. This allows an attacker to pre-authenticate a session and trick a victim into logging into the attacker's account. Any data the victim then enters or academic progress they make is stored on