CVE-2026-25222 PolarLearn Affected by User Enumeration via Argon2 Timing Attack on Sign-In Endpoint

Medium 6.3 Published 2 Feb 2026 Updated 4 Feb 2026

Unauthenticated attackers can enumerate registered users by timing login responses, revealing valid email addresses on the PolarLearn platform.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Over the internet
Victim action needed: Not needed
Fix: None listed

What is CVE-2026-25222?

CVE-2026-25222 is a medium-severity vulnerability in polarnl PolarLearn, published on 2 Feb 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

PolarLearn is a free and open-source learning program. In 0-PRERELEASE-15 and earlier, a timing attack vulnerability in the sign-in process allows unauthenticated attackers to determine if a specific email address is registered on the platform. By measuring the response time of the login endpoint, an attacker can distinguish between valid and invalid email addresses. This occurs because the server only performs the computationally expensive Argon2 password hashing if the user exists in the database. Requests for existing users take significantly longer (~650ms) than requests for non-existent users (~160ms).

Weakness: CWE-200

Which versions are affected by CVE-2026-25222?

It affects 1 product.

Products include Polarlearn Polarlearn.

How do I fix CVE-2026-25222?

No fix has been published for CVE-2026-25222 yet. Limit exposure of the affected software until one is available.

Is CVE-2026-25222 being exploited?

It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-25222 exists.

Sources

Also known as GHSA-wcr9-mvr9-4qh5.