by Kastro
Paper/Archive/CVE-2026-63160

CVE-2026-63160

Omnispace Agora Project — Omnispace Agora Project < 26.10.0 Insecure Remember-Me Token Storage

EPSS 0.3%CVSS 9.1
critical.is priorityof 100
33
CVSS 9.1 (CNA)9.1 / 10 × 3027.3Not in CISA KEV+300.0EPSS percentile 25.8.258 × 205.2No public exploit+100.0SSVC exploitation: none+100.0
Description · from the CVE record

Omnispace Agora Project before 26.10.0 contains a vulnerability where the persistent remember-me token is stored verbatim server-side, making the stored value identical to the bearer credential held in the user's cookie. Attackers who gain access to the stored token, such as through database or backup disclosure, can replay the plaintext value to authenticate as the victim user without needing their password.

Affected

ProductAffectedFixed inSource
Agora Project< 26.10.026.10.0CNA

Scores by source

VulnCheck (CNA)9.1CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N
VulnCheck (CNA)7.4CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N
CISA ADPSSVCExploitation: none · Automatable: no · Technical impact: total

References

patchgithub.com/xech/agora-project/releases/tag/26.10refagora-project.netwriteupvulncheck.com/advisories/omnispace-agora-project-insecure-remember-me-token-storage