CVE-2026-64961
Received Received - Intake

Authentication Bypass in ATutor via Uninitialized Token

Publication date: 2026-08-20

Last updated on: 2026-08-20

Assigner: CERT.PL

Description
ATutor is vulnerable to authentication bypass . Although a token validation check is present in the auto-login functionality, the values required for token validation remain uninitialized in certain code paths. An unauthenticated attacker who can determine a user's identifier and registration timestamp can generate a valid token and authenticate as an existing user, including administrator, without knowing the password. Product is no longer actively supported and the vulnerabilities have not been fixed. Only version 2.2.4 was tested and confirmed as vulnerable, other versions were not tested but might also be vulnerable.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-20
Last Modified
2026-08-20
Generated
2026-08-20
AI Q&A
2026-08-20
EPSS Evaluated
N/A
NVD
CVE-2026-64961
EUVD
EUVD-2026-63361

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
atutor atutor to 2.2.4 (inc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-639 The system's authorization functionality does not prevent one user from gaining access to another user's data or record by modifying the key value identifying the data.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

ATutor has an authentication bypass vulnerability due to uninitialized token validation values in the auto-login functionality. An attacker can exploit this by knowing a user's identifier and registration timestamp to generate a valid token and authenticate as that user, including administrators, without a password.

Impact Analysis

An attacker could gain unauthorized access to user accounts, including administrative accounts, potentially leading to data theft, manipulation, or system compromise. Since the product is no longer supported, there is no official fix available.

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive data, violating confidentiality requirements in GDPR and HIPAA. Organizations using ATutor may face compliance violations, legal penalties, and reputational damage due to potential data breaches.

Mitigation Strategies

Disable the auto-login functionality in ATutor if possible. Since the product is no longer supported and unpatched, consider migrating to an alternative solution. Ensure all user accounts, especially administrative ones, have strong unique passwords.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-64961. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart