I use a service for improving my English which includes authentication for users, it has a feature for sending emails for some types of new exercises. I was surprised when I saw the URL for emails:


autologin_key is different for all emails. If I get it the right way, this URL allows anyone to login to my account without even knowing the password.

Is this a potential vulnerability?

UPD: this key allow full access to my account, including changing personal information, like email and password (it will make impossible to recover access for me).

  • Any change password or email settings should request authentication is you were allowed to autologin
    – bradbury9
    Jul 31, 2018 at 11:20

1 Answer 1


Obviously the service providers assumes that only you can access your mail account. The service provider decided that a temporary value of autologin_key with probably limited validity period is secure enough to authenticate you.

Whether the (rather bad) e-mail confidentiality is really secure enough depends on what harm an attacker can do to you or the service provider.

E.g. does this credential authorize you to...

  • just access read-only content of training courses or
  • does it allow see personal data
  • does it even allow modifying your personal data, e.g. consuming training stuff making it unusable/unreachable for you
  • or even worse to order more services you will be charged for

After all it's always a choice of convenience vs. security. Sometimes the trade-off can be hard to find.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .