CVE-2026-39322 - Vulnerability Analysis

Overview

PolarLearn <= 0-PRERELEASE-15 contains a broken authentication caused by session creation before password verification in POST /api/v1/auth/sign-in, letting attackers access banned accounts and perform authenticated actions, exploit requires crafted sign-in request.

Severity & Score

Impact

Attackers can access banned user accounts and perform authenticated actions, bypassing account restrictions.

Mitigation

Update to a version later than 0-PRERELEASE-15 or latest available version.

References

• https://github.com/polarnl/PolarLearn/security/advisories/GHSA-9vx4-7ww7-4cf5

Related Resources

• Vulnerability Intelligence Dashboard
• Credential Scanner