CVE-2026-25222

PolarLearn (0-PRERELEASE-15 and earlier) contains a timing-attack vulnerability in the sign-in endpoint that allows unauthenticated attackers to enumerate registered email addresses by measuring response times. The server performs Argon2 hashing only if the user exists; existing users respond ~65...