Which versions of Polarlearn are affected by CVE-2026-39322?

PolarLearn versions 0-PRERELEASE-15 and earlier contain a critical authentication bypass vulnerability (CVSS 9.2) in the sign-in endpoint that allows unauthenticated attackers to gain full account…

How to fix or mitigate CVE-2026-39322?

Within 24 hours: Identify all PolarLearn deployments and their current versions; isolate systems running version 0-PRERELEASE-15 or earlier from untrusted networks if possible. Within 7 days: Contact PolarLearn vendor for patch availability and interim guidance; implement network-level access controls restricting /api/v1/auth/sign-in endpoint to trusted sources only. Within 30 days: Apply vendor-released patch immediately upon availability; conduct forensic review of authentication logs for indicators of exploitation; reset credentials for all user accounts as a precautionary measure.

Polarlearn CVE-2026-39322

Q: What is the CVSS score of CVE-2026-39322?

CVE-2026-39322 has a CVSS 4.0 base score of 9.2 (Critical). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

EUVD-2026-19853 CRITICAL

Improper Authentication (CWE-287)

2026-04-07 GitHub_M

Authentication Bypass Polarlearn

9.2

CVSS 4.0 · Vendor: GitHub_M

Severity by source

Vendor (GitHub_M) PRIMARY

9.2 CRITICAL

CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from Vendor (GitHub_M) · only source for this CVE.

CVSS VectorVendor: GitHub_M

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

EUVD ID Assigned

Apr 07, 2026 - 20:16 euvd

EUVD-2026-19853

Analysis Generated

Apr 07, 2026 - 20:16 vuln.today

CVE Published

Apr 07, 2026 - 19:03 nvd

CRITICAL 9.2

DescriptionCVE.org

PolarLearn is a free and open-source learning program. In 0-PRERELEASE-15 and earlier, POST /api/v1/auth/sign-in creates a valid session for banned accounts before verifying the supplied password. That session is then accepted across authenticated /api routes, enabling account data access and authenticated actions as the banned user.

AnalysisAI

Authentication bypass in PolarLearn ≤0-PRERELEASE-15 allows unauthenticated remote attackers to gain authenticated session access as banned users without password verification. The flaw enables complete account takeover and unauthorized data access through a session generation vulnerability in the /api/v1/auth/sign-in endpoint. CVSS 9.2 (Critical) reflects network-based attack with low complexity and no authentication required. No public exploit identified at time of analysis, but exploitation is straightforward given the authentication bypass mechanism.

Technical ContextAI

This vulnerability affects PolarLearn (cpe:2.3:a:polarnl:polarlearn), a free and open-source learning management platform. The root cause is CWE-287 (Improper Authentication), specifically an incorrect order-of-operations flaw in the authentication flow. The POST /api/v1/auth/sign-in endpoint creates and assigns a valid session token before performing password verification. This session state management error violates the fundamental security principle that authentication challenges must be fully validated before granting access credentials. The vulnerability is particularly severe because it bypasses the account banning mechanism entirely - a critical security control designed to prevent unauthorized access. Once a session is created for a banned account, it remains valid across all authenticated /api routes despite the account's banned status and the absence of correct password submission. This represents a complete authentication subsystem failure where access control checks occur in the wrong sequence.

RemediationAI

Upgrade immediately to PolarLearn version 0-PRERELEASE-16 or later, which addresses the authentication sequence vulnerability by enforcing password verification before session creation. Review the official vendor security advisory at https://github.com/polarnl/PolarLearn/security/advisories/GHSA-9vx4-7ww7-4cf5 for detailed patch information and any additional configuration changes required. Until patching is complete, implement immediate compensating controls: disable the /api/v1/auth/sign-in endpoint at the web application firewall or reverse proxy level, restrict API access to trusted IP addresses only, and audit all authentication logs for suspicious session creation patterns involving banned accounts. Conduct a security review of all session tokens generated since deployment to identify potentially compromised sessions - invalidate all existing sessions and force re-authentication of legitimate users after patching. Given this is pre-release software, evaluate whether production use is appropriate; consider postponing deployment until the platform reaches stable release status with comprehensive security testing. Monitor the GitHub repository for follow-up security updates and subscribe to the project's security advisories for future vulnerability notifications.