PolarLearn, an open-source learning platform, suffers from a CSRF vulnerability (CVE-2026-25221) in its OAuth 2.0 login flow for GitHub and Google authentication providers in versions up to 0-PRERELEASE-15. The root cause is the absence of the OAuth state parameter implementation and verification, which is critical to prevent CSRF attacks during OAuth authentication. Without this protection, an attacker can craft a malicious link or webpage that forces a victim to authenticate into the attacker’s account instead of their own. Consequently, any data the victim inputs or academic progress they make is recorded under the attacker’s account, resulting in data loss for the victim and potential exposure of personal or academic information to the attacker. The vulnerability requires the victim to interact with a crafted link or page but does not require the attacker to have prior access or authentication. The CVSS 4.0 vector indicates network attack vector, low complexity, no privileges required, but user interaction is necessary. The impact on confidentiality and availability is minimal, but the integrity of user data is compromised. No patches or mitigations are currently linked, and no active exploits have been reported. This vulnerability primarily affects educational organizations using PolarLearn for managing learning activities and user progress.

For European organizations, particularly educational institutions and e-learning providers using PolarLearn, this vulnerability could lead to significant data integrity issues. Students or users may unknowingly have their academic progress and personal data recorded under an attacker’s account, causing confusion, loss of academic records, and potential privacy breaches. Although the confidentiality and availability impacts are low, the integrity loss could undermine trust in the platform and disrupt learning outcomes. This could also lead to compliance issues under GDPR if personal data is improperly handled or disclosed. The attack requires user interaction, so phishing or social engineering campaigns could be used to exploit this vulnerability. While no known exploits exist yet, the risk remains relevant as adoption of PolarLearn grows in Europe.

Organizations should immediately upgrade PolarLearn to a version that implements and verifies the OAuth state parameter in the authentication flow once available. Until a patch is released, administrators should consider disabling OAuth login providers (GitHub and Google) or restrict their use to trusted users only. Implementing additional monitoring for suspicious login behaviors and educating users about phishing and social engineering risks can reduce exploitation likelihood. Developers and administrators can also implement web application firewalls (WAFs) with rules to detect and block CSRF attempts targeting OAuth endpoints. Regularly auditing OAuth flows for proper state parameter usage and ensuring secure session management practices are critical. Finally, organizations should prepare incident response plans to address potential data integrity issues arising from this vulnerability.