Unauthenticated account activation via predictable token

Authentication bypass in ATutor 2.2.4 allows remote attackers to activate unconfirmed accounts via a guessed email token. In confirm.php, the activation code is the first 10 characters of md5(email + creation_date + member_id), so account confirmation accepts a token derived from predictable registration fields instead of a secret random value. No prior access or mailbox access is required, but the attacker must know or predict the target account's email address, creation timestamp, and member ID; the consequence is limited to confirming the pending account.