I use a service for improving my English which includes authentication for users, it has a feature for sending emails for some types of new exercises. I was surprised when I saw the URL for emails:
autologin_key is different for all emails. If I get it the right way, this URL allows anyone to login to my account without even knowing the password.
Is this a potential vulnerability?
UPD: this key allow full access to my account, including changing personal information, like email and password (it will make impossible to recover access for me).