Executive brief
ATutor is an open-source learning management system used by educational institutions to develop and manage online courses. The account confirmation functionality generates predictable email tokens that attackers can guess, allowing them to activate user accounts without access to the victim's email inbox. This enables unauthorized account access and potential course material tampering or data theft.
Technical details
ATutor generates account confirmation tokens using insufficiently random values derived from predictable user registration data (CWE-340: Generation of Predictable Numbers or Identifiers). An attacker who can determine or infer user identifiers and registration timestamps can compute valid activation tokens without network authentication. The vulnerability affects the account confirmation flow, which is unauthenticated and reachable by any user attempting registration. Successful exploitation results in account activation for any target user account. The product is no longer actively maintained and patches are not available; only version 2.2.4 has been confirmed vulnerable, though other versions likely contain the same flaw.
Affected products
- ATutor ATutor 2.2.4 (confirmed); other versions likely vulnerable
Timeline
- 2026-08-20: disclosed