The vulnerability in PolarLearn’s authentication endpoint allows any password to authenticate a banned account because the system verifies the password only after creating a session. This results in the creation of a valid session that is then accepted by all authenticated API routes, giving an attacker access to account data and the ability to perform actions as the banned user. The weakness is a loss of authentication control (CWE‑287).

The affected product is PolarLearn, as supplied by polarlearn. Vulnerable releases are those up to and including 0‑PRERELEASE‑15. Versions 0‑PRERELEASE‑16 and later are not affected.

The CVSS score of 9.2 indicates a high‑severity problem, and while the EPSS score is below 1% and the vulnerability is not listed in CISA’s KEV catalog, the ability to bypass authentication renders it a critical risk. An attacker would need to send a signed POST request to /api/v1/auth/sign-in with the user’s email and any arbitrary password. The exploit requires network access to the API endpoint; no local privilege escalation or code execution is required.