Executive brief
PolarLearn, an open-source learning platform, contains a security flaw that allows unauthorized access to banned user accounts. By attempting to log in to a banned account, the system mistakenly creates a valid session before checking if the password is correct. This allows an attacker who knows a banned user's email address to take over that account, access private data, and perform actions as that user without needing their password.
Technical details
An authentication bypass exists in the `signInCredentials()` function of PolarLearn. When a login attempt is made against a banned account, the application logic triggers `createSession()` and returns a response before the password hash comparison occurs. While a proxy middleware is intended to enforce bans, it explicitly excludes `/api` routes, and `getUserFromSession()` fails to validate the account's ban status. Consequently, an attacker knowing a banned user's email can obtain a valid session token with an arbitrary password and access authenticated API endpoints, such as data exports and account settings.
Affected products
- polarnl PolarLearn <= 0-PRERELEASE-15
Timeline
- 2026-04-05: advisory: GitHub Security Advisory published
- 2026-04-07: disclosed: NVD publication date