CVE-2026-25221: PolarLearn OAuth Login CSRF Vulnerability

CVE-2026-25221 Overview

CVE-2026-25221 is a Login Cross-Site Request Forgery (CSRF) vulnerability affecting the OAuth 2.0 implementation in PolarLearn, a free and open-source learning platform. The vulnerability exists in the GitHub and Google login providers where the application fails to implement and verify the state parameter during the OAuth authentication flow.

This security flaw allows attackers to pre-authenticate a session and trick victims into logging into the attacker's controlled account. When victims unknowingly use the attacker's session, any academic progress, personal data, or educational content they create becomes stored under the attacker's account, resulting in data loss for the victim and information disclosure to the attacker.

Critical Impact

Attackers can hijack user sessions through Login CSRF, causing victims to unknowingly contribute their academic data and progress to attacker-controlled accounts.

Affected Products

• PolarLearn version 0-PRERELEASE-15 and earlier
• PolarLearn instances using GitHub OAuth login
• PolarLearn instances using Google OAuth login

Discovery Timeline

• 2026-02-02 - CVE CVE-2026-25221 published to NVD
• 2026-02-03 - Last updated in NVD database

Technical Details for CVE-2026-25221

Vulnerability Analysis

The vulnerability stems from a missing security control in the OAuth 2.0 authentication implementation. OAuth 2.0 specifies that applications should use a state parameter as a CSRF protection mechanism during the authorization flow. This parameter should be a cryptographically random value that the client generates before initiating the OAuth flow, stores locally, and then verifies when the authorization server redirects back with an authorization code.

PolarLearn's implementation omits this critical security measure for both GitHub and Google OAuth providers. Without state parameter validation, an attacker can initiate an OAuth flow from their own browser, obtain an authorization URL, and then deliver that URL to a victim. When the victim clicks the malicious link, they complete the OAuth flow and become authenticated as the attacker.

This is classified under CWE-352 (Cross-Site Request Forgery), specifically the Login CSRF variant where the attack targets the authentication process itself rather than authenticated actions.

Root Cause

The root cause is the missing implementation of the state parameter in the OAuth 2.0 authorization request. The application generates OAuth authorization URLs without including a unique, unpredictable state value. Additionally, the callback handler that processes the OAuth response does not verify any state parameter against a stored session value. This allows an attacker-initiated OAuth flow to be completed by a victim without any validation that the same user started and completed the authentication request.

Attack Vector

The attack leverages network-based social engineering to execute the Login CSRF. An attacker initiates the OAuth login flow on PolarLearn, which generates an authorization URL for either GitHub or Google. The attacker captures this authorization URL before completing authentication. The attacker then delivers this URL to a victim through phishing emails, malicious links, or other social engineering techniques. When the victim clicks the link and authorizes their GitHub or Google account, they are logged into PolarLearn under the attacker's pre-authenticated session. Any subsequent activity by the victim, including course enrollments, assignment submissions, quiz results, and personal information updates, becomes associated with the attacker's account.

The attacker can later access their PolarLearn account to harvest all data and academic progress submitted by the victim during the hijacked session.

Detection Methods for CVE-2026-25221

Indicators of Compromise

• Multiple OAuth callback requests to PolarLearn instances lacking a state parameter
• User accounts showing activity from multiple geographic locations or IP addresses that don't match the account owner's typical patterns
• Reports from users about missing academic progress or data they previously submitted
• Unusual patterns in account creation followed by high-value academic content appearing shortly after

Detection Strategies

• Monitor OAuth callback endpoints for requests missing the state parameter
• Implement logging to track OAuth flow initiation and completion, alerting on flows where IP addresses differ significantly
• Review web server access logs for patterns indicating the same authorization URL being accessed from different user sessions

Monitoring Recommendations

• Enable detailed authentication logging on PolarLearn instances
• Configure alerts for OAuth flows completed without state parameter validation
• Monitor for user complaints regarding missing or misattributed academic progress
• Track unusual session patterns where login location differs significantly from subsequent activity location

How to Mitigate CVE-2026-25221

Immediate Actions Required

• Upgrade PolarLearn to a version that includes the security patch (commit 44669bbb5b647c7625f22dd82f3121c7d7bfbe19)
• Review user activity logs for any signs of Login CSRF exploitation
• Notify users to verify their account data and report any discrepancies
• Consider temporarily disabling OAuth login and using alternative authentication methods until patched

Patch Information

The vulnerability has been addressed in the commit 44669bbb5b647c7625f22dd82f3121c7d7bfbe19. This patch implements proper state parameter generation, storage, and verification in the OAuth 2.0 flow for both GitHub and Google login providers. Administrators should update their PolarLearn installation to include this commit.

For detailed information about the vulnerability and the fix, refer to the GitHub Security Advisory GHSA-fhhm-574m-7rpw.

Workarounds

• Disable GitHub and Google OAuth login providers until the patch can be applied
• Implement network-level controls to validate OAuth callback requests
• Educate users about the risks of clicking authentication links from untrusted sources
• Deploy a web application firewall (WAF) rule to reject OAuth callbacks without state parameters

# Example: Disable OAuth providers in PolarLearn configuration
# Modify your environment configuration or settings file
OAUTH_GITHUB_ENABLED=false
OAUTH_GOOGLE_ENABLED=false
# Alternatively, restrict OAuth callback routes at the reverse proxy level
# nginx example - block OAuth callbacks without state parameter
# location /oauth/callback {
#     if ($arg_state = "") {
#         return 403;
#     }
#     proxy_pass http://polarlearn_backend;
# }