CVE-2026-64961: Authentication Bypass in ATutor
ATutor is vulnerable to authentication bypass . Although a token validation check is present in the auto-login functionality, the values required for token validation remain uninitialized in certain code paths. An unauthenticated attacker who can determine a user's identifier and registration timestamp can generate a valid token and authenticate as an existing user, including administrator, without knowing the password.
Product is no longer actively supported and the vulnerabilities have not been fixed. Only version 2.2.4 was tested and confirmed as vulnerable, other versions were not tested but might also be vulnerable.
Affected Software
Event History
Frequently Asked Questions
What does an attacker need to exploit this issue?
The attacker must be unauthenticated and able to determine the target user's identifier and registration timestamp. With those values, they can generate a valid auto-login token without knowing the user's password.
Can this lead to administrator access?
Yes. An attacker can authenticate as an existing user, including an administrator, if they can obtain that user's identifier and registration timestamp.
Which versions are known to be affected?
Version 2.2.4 was tested and confirmed vulnerable. Other versions were not tested and may also be vulnerable.
Is a patch available?
No fix is identified, and the product is no longer actively supported. The reported vulnerabilities have not been fixed.