CVE-2026-64964mediumCWE-340

CVE-2026-64964: medium-severity vulnerability in ATutor

Generation of Predictable Email Confirmation Token in ATutor

Published

Follow this CVE+ Monitor ATutor

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

13Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackcvss 6.3epss 0.4%
ATutor generates predictable email confirmation tokens due to the use of insufficiently random values in the account confirmation functionality. Due to the use of predictable values related to user registration, an attacker who knows or can predict these values can guess valid account activation tokens. This allows an attacker to activate an unconfirmed account without access to the victim's email inbox. Product is no longer actively supported and the vulnerabilities have not been fixed. Only version 2.2.4 was tested and confirmed as vulnerable, other versions were not tested but might also be vulnerable.
CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N
Affected products
ATutor · ATutor
Related CVEs — ATutor

In the same product, most dangerous first.

CVE-2026-64966HIGHPath Traversal leading to Remote Code Execution in ATutorEPSS 0.7%CVE-2026-64960HIGHRemote Code Execution via Unrestricted File Upload in ATutorEPSS 0.6%CVE-2026-64963LOWPath Traversal in ATutorEPSS 0.5%CVE-2026-64971MEDIUMReflected XSS in ATutorEPSS 0.5%CVE-2026-64967MEDIUMPath Traversal in ATutorEPSS 0.5%CVE-2026-64961MEDIUMAuthentication Bypass in ATutorEPSS 0.5%