ATutor contains a flaw that allows an unauthenticated attacker to fabricate a valid auto‑login token if they know a user’s identifier and registration timestamp. The token validation logic is present, but the required values remain uninitialized in certain code paths, meaning the cryptographic check passes even when the data is missing. By forging the token, an attacker can authenticate as any existing user, including administrators, without possessing the user’s password.

The vulnerability has been confirmed in ATutor version 2.2.4, the last actively supported release. Other versions have not been tested but may exhibit the same weakness due to the unchanged code path, so all ATutor installations should be considered potentially affected. The product is no longer maintained, and no patch is available.

The CVSS score of 6.3 indicates a moderate severity issue. Because exploitation requires knowledge of a user’s ID and registration timestamp, it is not trivial to harvest these values from the public interface, but the surface is small and the token can be sent over any network to the login endpoint. No proof‑of‑concept exploit has been disclosed and the vulnerability is not listed in the CISA KEV catalog, meaning the exploitation probability is unknown. Nonetheless, the potential impact of gaining administrative access is high enough that organizations should evaluate the risk promptly.