Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
9.1

Omnispace Agora Project lets attackers log in with stolen password hash

CVE-2026-63158 · published today
Summary

Versions of Omnispace Agora Project before 26.10.0 treat a stored password hash like a login token. If someone obtains that hash, they can set a special cookie and sign in as any user, even an administrator, without knowing the actual password. Update to version 26.10.0 or later to stop this from happening.

Original advisory text
Omnispace Agora Project before 26.10.0 contains an authentication bypass vulnerability that allows attackers possessing a user's stored bcrypt password hash to authenticate as that user without kno...
Omnispace Agora Project before 26.10.0 contains an authentication bypass vulnerability that allows attackers possessing a user's stored bcrypt password hash to authenticate as that user without knowing the actual password, caused by the legacy AGORAP_LOG/AGORAP_PASS cookie mechanism treating the stored hash as a directly replayable bearer credential. Attackers can set the AGORAP_LOG/AGORAP_PASS cookies with a stolen password hash to impersonate any user, including administrators, and gain unauthorized access to the application.
References
Fix within
Internet-facing 3 days
Internal 60 days
  • Not known to be exploited
  • Can be exploited automatically (estimated)
  • Gives an attacker full control (estimated)
Severity
9.1 Critical
Type
CWE-836Use of Password Hash Instead of Password for Authentication
Timeline
Published13 Oct 2026
Updated13 Oct 2026
First seen13 Oct 2026
Sources
CVE-2026-63158 · NVD
Track software like this
Free during beta