Login key in email

Question

I use a service for improving my English which includes authentication for users, it has a feature for sending emails for some types of new exercises. I was surprised when I saw the URL for emails:

https://puzzle-english.com/video/arnold_openspace?autologin_key=*long_hash*&user_email=*my_email*&expire=1533573237&pes=email_letter_every_day

autologin_key is different for all emails. If I get it the right way, this URL allows anyone to login to my account without even knowing the password.

Is this a potential vulnerability?

UPD: this key allow full access to my account, including changing personal information, like email and password (it will make impossible to recover access for me).

Answer 1

Obviously the service providers assumes that only you can access your mail account. The service provider decided that a temporary value of autologin_key with probably limited validity period is secure enough to authenticate you.

Whether the (rather bad) e-mail confidentiality is really secure enough depends on what harm an attacker can do to you or the service provider.

E.g. does this credential authorize you to...

• just access read-only content of training courses or
• does it allow see personal data
• does it even allow modifying your personal data, e.g. consuming training stuff making it unusable/unreachable for you
• or even worse to order more services you will be charged for

After all it's always a choice of convenience vs. security. Sometimes the trade-off can be hard to find.