The vulnerability is a timing side‑channel on PolarLearn’s sign‑in API. Attackors measuring response times can determine whether an email address is registered, allowing them to enumerate valid user accounts. The flaw originates because the Argon2 password hash is computed only when the user exists, producing a noticeable delay that is exploitable through simple timing measurements. This exposure of sensitive information maps to CWE‑200.

PolarLearn versions 0‑PRERELEASE‑15 and earlier are affected. The project resides on GitHub under the polarnl organization; only these releases contain the vulnerable logic. Newer releases are presumed to have addressed the issue.

The CVSS base score is 6.3, indicating moderate severity. EPSS reports a very low exploitation probability (< 1 %). The vulnerability is not listed in the KEV catalog. The attack vector is network‑based and does not require privileged access; any unauthenticated user with connectivity to the sign‑in endpoint can iterate over email addresses and observe timing differences, enabling user enumeration.