PolarLearn Session Creation Vulnerability for Banned Accounts Allowing Unauthorized Access

A vulnerability in PolarLearn versions through v0-PRERELEASE-15 allows banned accounts to create valid sessions via the POST /api/v1/auth/sign-in endpoint. This occurs before the supplied password is verified, enabling unauthorized access to account data and authenticated actions as the banned user. The issue arises because the sign-in process does not properly enforce bans before session creation, and the resulting sessions are accepted across authenticated API routes.

Impact

Exploitation of this vulnerability allows access to a banned user's account data and the ability to perform authenticated actions on their behalf, until the session expires.