What is the CVSS score of CVE-2026-25222?

CVE-2026-25222 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N. EPSS exploitation probability: 0.0%.

Which versions of Polarlearn are affected by CVE-2026-25222?

A timing attack vulnerability in PolarLearn's sign-in process allows attackers to enumerate registered email addresses without authentication, potentially enabling targeted phishing campaigns and…. A patch is available.

Is there a public PoC exploit available for CVE-2026-25222?

Yes, a public proof-of-concept exploit is available for CVE-2026-25222. Prioritise patching immediately. EPSS: 0.0%.

How to fix or mitigate CVE-2026-25222?

Within 24 hours: Inventory all systems running PolarLearn 0-PRERELEASE-15 or earlier and assess user population exposure. Within 7 days: Apply the available vendor patch to all affected instances and validate successful deployment across environments. Within 30 days: Review access logs for evidence of timing-based enumeration attacks and notify users if unauthorized email address harvesting is detected.

Polarlearn CVE-2026-25222

HIGH

Information Exposure (CWE-200)

2026-02-02 security-advisories@github.com

Information Disclosure Polarlearn

7.5

CVSS 3.1 · GitHub Advisory

Severity by source

GitHub Advisory PRIMARY

7.5 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Primary rating from GitHub Advisory · only source for this CVE.

CVSS VectorGitHub Advisory

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

Analysis Generated

Mar 12, 2026 - 22:01 vuln.today

PoC Detected

Feb 20, 2026 - 20:48 vuln.today

Public exploit code

Patch released

Feb 20, 2026 - 20:48 nvd

Patch available

CVE Published

Feb 02, 2026 - 23:16 nvd

HIGH 7.5

DescriptionGitHub Advisory

PolarLearn is a free and open-source learning program. In 0-PRERELEASE-15 and earlier, a timing attack vulnerability in the sign-in process allows unauthenticated attackers to determine if a specific email address is registered on the platform. By measuring the response time of the login endpoint, an attacker can distinguish between valid and invalid email addresses. This occurs because the server only performs the computationally expensive Argon2 password hashing if the user exists in the database. Requests for existing users take significantly longer (~650ms) than requests for non-existent users (~160ms).

AnalysisAI

Email enumeration in PolarLearn through timing analysis of the login endpoint allows unauthenticated attackers to identify valid user accounts by observing response time differences between existing and non-existent users. The vulnerability stems from the server only performing expensive password hashing for registered accounts, creating a measurable timing side-channel. Public exploit code exists for this vulnerability affecting PolarLearn version 0-PRERELEASE-15 and earlier.

Technical ContextAI

Classified as CWE-200 (Information Exposure). Affects Polarlearn. PolarLearn is a free and open-source learning program. In 0-PRERELEASE-15 and earlier, a timing attack vulnerability in the sign-in process allows unauthenticated attackers to determine if a specific email address is registered on the platform. By measuring the response time of the login endpoint, an attacker can distinguish between valid and invalid email addresses. This occurs because the server only performs the computationally expensive Argon2 password hashing if the user exists in the datab