[ CVE-2026-63160 · Published 13 Oct 2026 ]
Vulnerability in Omnispace Agora Project
CVSS 7.4
EPSS <1%No fix listed yet
[ Description ]Official description
Omnispace Agora Project before 26.10.0 contains a vulnerability where the persistent remember-me token is stored verbatim server-side, making the stored value identical to the bearer credential held in the user's cookie. Attackers who gain access to the stored token, such as through database or backup disclosure, can replay the plaintext value to authenticate as the victim user without needing their password.
[ Fixes ]Fixes and patches
No fix or interim patch is linked from our sources yet. Check the vendor references below and limit exposure of affected systems until a fix is available.