PolarLearn can be tricked into using a pre‑authenticated session from an attacker when the OAuth 2.0 flow omits the required state parameter. The flaw allows an attacker to have a victim log in as the attacker’s account, after which any content the victim creates or data entered is recorded under the attacker’s profile. As a result, the victim suffers loss of data and the attacker gains unauthorized access to the victim’s information.

The vulnerability affects the PolarLearn application from vendor polarnl, specifically versions 0‑PRERELEASE‑15 and all earlier releases. Versions that include state parameter validation after the commit 44669bbb5b647c7625f22dd82f3121c7d7bfbe19 are not impacted.

With a CVSS score of 2.3 and an EPSS probability of less than 1%, the likelihood of exploitation is low, and the vulnerability is not listed in the CISA KEV catalog. The attack would require an attacker to supply a link that forces a victim’s browser to initiate an OAuth request, relying on the victim to interact with the login flow. The gain is limited to data owned by the victim and the attacker’s account, but the impact on confidentiality and integrity of the victim’s account is significant. Given the low exploit probability and absence of a known public exploit, the risk is considered moderate but should still be mitigated promptly.