Email Activation Vulnerability in ATutor by Atutor
CVE-2026-64964

6.3MEDIUM

Key Information:

Vendor

Atutor

Status
Atutor
Vendor
CVE Published:
20 August 2026

What is CVE-2026-64964?

ATutor contains a vulnerability in its account confirmation functionality that leverages predictable email confirmation tokens. This weakness arises from the use of insufficiently random values, allowing attackers to potentially guess valid activation tokens. Such exploitation enables unauthorized activation of user accounts without requiring access to the victim's email. The product is no longer actively supported, and while version 2.2.4 has been confirmed vulnerable, other versions may also be at risk.

Affected Version(s)

ATutor 2.2.4

References

https://cert.pl/en/posts/2026/08/CVE-2026-64960
third-party-advisory
https://atutor.github.io/
product

CVSS V4

Score:
6.3
Severity:
MEDIUM
Confidentiality:
None
Integrity:
Low
Availability:
None
Attack Vector:
Network
Attack Complexity:
High
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Michał Majchrowicz (AFINE Team)
Marcin Wyczechowski (AFINE Team)
.