CVE-2026-25885
HIGHPolarLearn <0-PRERELEASE-16 - SSRF
Title source: llmDescription
PolarLearn is a free and open-source learning program. In 0-PRERELEASE-16 and earlier, the group chat WebSocket at wss://polarlearn.nl/api/v1/ws can be used without logging in. An unauthenticated client can subscribe to any group chat by providing a group UUID, and can also send messages to any group. The server accepts the message and stores it in the group’s chatContent, so this is not just a visual spam issue.
Scores
CVSS v3
7.5
EPSS
0.0004
EPSS Percentile
10.6%
Attack Vector
NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
Classification
CWE
CWE-306
CWE-285
Status
published
Affected Products (1)
polarlearn/polarlearn
Timeline
Published
Feb 09, 2026
Tracked Since
Feb 18, 2026