Read the docs
TI-2026-20925 Aliases CVE-2026-25885

PolarLearn allows Unauthenticated WebSocket access allows subscribing to and posting in arbitrary group chats

Priority MEDIUM 49CWE-285Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Attack requirements
None
Impact type
Security bypass
Confidentiality · integrity · availability
High · High · Low
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-285.

Summary

PolarLearn is a free and open-source learning program. In 0-PRERELEASE-16 and earlier, the group chat WebSocket at wss://polarlearn.nl/api/v1/ws can be used without logging in. An unauthenticated client can subscribe to any group chat by providing a group UUID, and can also send messages to any group. The server accepts the message and stores it in the group’s chatContent, so this is not just a visual spam issue.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.0034 27th percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by NVD
Fix Fixed PolarLearn (polarnl): 0-PRERELEASE-16

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
Yes
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
polarnlPolarLearnbefore 0-PRERELEASE-160-PRERELEASE-16Patch availableCNA
  • PolarLearn Vendorpolarnl Affected before 0-PRERELEASE-16 Fixed in 0-PRERELEASE-16 Patch available CNA

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:polarlearn:polarlearn:-:*:*:*:*:*:*:*not specified by NVDVulnerablepolarnl
  • cpe:2.3:a:polarlearn:polarlearn:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·polarnl

Remediation

  • Fix · CNA PolarLearn (polarnl) Fixed in 0-PRERELEASE-16

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-25885

References

Exploit 1

Patch 1

  • TI-2026-27712 PolarLearn has a Server Action Admin Bypass in Account Management Actions CVSS 3.1HIGH 8.8
  • TI-2026-20372 PolarLearn Affected by User Enumeration via Argon2 Timing Attack on Sign-In Endpoint CVSS 4.0MEDIUM 6.3
  • TI-2026-20371 PolarLearn has Multiple Login CSRFs via Missing OAuth state Parameter (GitHub & Google) CVSS 4.0LOW 2.3
  • TI-2026-28311 PolarLearn: Any password authenticates banned accounts and grants API access CVSS 4.0CRITICAL 9.2
  • TI-2026-20289 PolarLearn's unvalidated vote direction allows vote count manipulation CVSS 3.1HIGH 7.1

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences