ATutor’s account confirmation mechanism uses insufficiently random values, producing predictable email confirmation tokens. An attacker who can estimate these values can issue a valid activation request and enable an unconfirmed user account without accessing the victim’s email inbox. This flaw allows the attacker to bypass the intended verification step and potentially gain access to user accounts that were still considered unverified.

ATutor version 2.2.4 is confirmed vulnerable, and other versions may share the same weakness because the source code remains unchanged. The product is no longer actively maintained and the vendor has not released a fix.

The flaw carries a CVSS score of 6.3 and has no known exploit probability score, and it is not listed in the CISA KEV catalog. Based on the description, the likely attack vector is the ability to guess or compute the confirmation token; attackers can repeatedly attempt activation until success. The moderate severity, absence of publicly available exploits, and lack of a vendor patch suggest a continued but moderate risk, particularly for installations that still allow email confirmation for new accounts.