CVE-2026-64961

Name of the Vulnerable Software and Affected Versions ATutor version 2.2.4

Description An authentication bypass exists in the auto-login functionality. While a token validation check is implemented, the values required for this validation remain uninitialized in specific code paths. An unauthenticated attacker who obtains a user's identifier and registration timestamp can generate a valid token to authenticate as any existing user, including administrators, without providing a password.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.