EUVD-2026-63361
GHSA-xh7m-r4hc-cm86
Severity by source
CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Network-reachable with no prior authentication; AC:H for required user ID and timestamp reconnaissance; admin takeover yields C:H/I:H; S:C because admin compromise affects all platform users.
Primary rating from Vendor (cert).
CVSS VectorVendor: cert
Lifecycle Timeline
1DescriptionCVE.org
ATutor is vulnerable to authentication bypass . Although a token validation check is present in the auto-login functionality, the values required for token validation remain uninitialized in certain code paths. An unauthenticated attacker who can determine a user's identifier and registration timestamp can generate a valid token and authenticate as an existing user, including administrator, without knowing the password.
Product is no longer actively supported and the vulnerabilities have not been fixed. Only version 2.2.4 was tested and confirmed as vulnerable, other versions were not tested but might also be vulnerable.
AnalysisAI
Authentication bypass in ATutor 2.2.4 allows unauthenticated remote attackers to impersonate any user, including administrators, by forging auto-login tokens without knowing the target account's password. The auto-login code path contains a token validation check whose required inputs remain uninitialized in certain execution branches, meaning an attacker who can determine a user's identifier and registration timestamp can generate a token the application accepts as legitimate. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | The auto-login functionality must be active and reachable - it is the specific affected code path. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The provided CVSS 4.0 score of 6.3 (Medium) with AC:H reflects the genuine prerequisite of obtaining the target's user identifier and registration timestamp before exploitation is possible. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | No vendor-released patch has been identified at time of analysis - ATutor is end-of-life and the maintainers have confirmed vulnerabilities will not be fixed. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
Same technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today