As admin, enable "Mobile services": Plugins ► Web Services ► Mobile Create a new user account (witout any speciail privilege) Get a normal token and private token via this URL (https required, you can mock your local is_https() if you want): https://localhost/m/stable_master/login/token.php?username=u22&password=u22&service=moodle_mobile_app Now, we must be quick, we are going to get an auto-login key that is valid for 60 seconds, we need to call this WS via curl command, please, replace the token and privatetoken values with the ones from step 3. curl 'https://localhost/m/stable_master/webservice/rest/server.php?moodlewsrestformat=json' --data 'privatetoken=5A69Msd6nlwVCkkcRZWk9luSvAJvzhNBopfBRYn0dFbqD7DoIia6YhyTetihH4a4&wsfunction=tool_mobile_get_autologin_key&wstoken=a853b7528eac30eb9d5d3ef5c26980d9' You will get as response a key and the autologin url Point your browser (ensure that there is not user logged in Moodle), to the autologin url, replacing your key and userid: https://localhost/m/stable_master/admin/tool/mobile/autologin.php?key=f7303ab9bc1f6b8ead09521d3960b92b&userid=120 Check that you are successfully logged in. Log out from Moodle site Try to access using again the same autologin.php url, you should get an error that the key is not valid Now, get another key via the curl WS call Try to log in via autologin.php but using an incorrect userid parameter, you should get an error 'invalidkey' Now, get another key via the curl WS call Wait more than 60 seconds Try to access via the autologin.php, you should get an error because the key is timed out Get another key, and now try to access via autologin php but using a different IP address (you can use Tor Browser for that), you should get an error Now, access Moodle as admin or a different user that the one you created the token for. Get a valid key and try to access via autologin.php in the same browser the other user is logged in, you will get an error because you are already logged in with a different user Finally, log in Moodle with the user you get the token for. Using a invalid key try to access via autologin.php, since you are already logged in you will be directly redirected without validating the key. Now, try to get a token and private token for the admin user like we did in 3 (you will need to delete any previous token for the admin user) You should receive the token but the private token will be null, this is because we prevent admins to generate private tokens via login/token.php In general, try to find any security hole in all the process