CVE-2026-39322 affects PolarLearn, an open-source learning platform, in versions up to v0-PRERELEASE-15. The vulnerability occurs in the POST /api/v1/auth/sign-in endpoint, which improperly creates a valid session for banned accounts before verifying the supplied password. Consequently, the session is accepted across authenticated API routes, enabling unauthorized access to account data and authenticated actions as the banned user. This is an improper authentication issue (CWE-287) with a critical severity rating.

An attacker can bypass authentication controls for banned accounts, gaining unauthorized access to account data and performing authenticated actions as those banned users. This undermines access control policies and could lead to data exposure or misuse of account privileges. There are no known exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or patch links are currently available. Until a patch is released, avoid using affected versions (<= v0-PRERELEASE-15) in production environments. Monitor vendor communications for updates and apply official fixes once available.