CVE-2026-64964 Generation of Predictable Email Confirmation Token in ATutor
Attackers can predict email confirmation tokens to activate unconfirmed accounts, bypassing email verification and potentially taking over accounts.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-64964?
CVE-2026-64964 is a medium-severity authentication bypass vulnerability in ATutor, published on 20 Aug 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
ATutor generates predictable email confirmation tokens due to the use of insufficiently random values in the account confirmation functionality. Due to the use of predictable values related to user registration, an attacker who knows or can predict these values can guess valid account activation tokens. This allows an attacker to activate an unconfirmed account without access to the victim's email inbox. Product is no longer actively supported and the vulnerabilities have not been fixed. Only version 2.2.4 was tested and confirmed as vulnerable, other versions were not tested but might also be vulnerable.
Weakness: CWE-340
Which versions are affected by CVE-2026-64964?
How do I fix CVE-2026-64964?
No fix has been published for CVE-2026-64964 yet. Limit exposure of the affected software until one is available.
Upgrade, and rotate credentials and sessions that may have been exposed. More about Authentication bypass.
Is CVE-2026-64964 being exploited?
There is no known exploitation of CVE-2026-64964 in the wild and no public exploit code.
Sources
Also known as GHSA-grqm-889w-4725.