Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
9.1
CVE-2026-63159: Omnispace Agora Project password reset can be guessed
CVE-2026-63159 · published today
Summary
The Agora Project version before 26.10.0 uses a password‑reset code that is calculated in a predictable way from the user’s login name and password. This lets someone without an account create a valid reset link and take over any user’s account. Update the software to version 26.10.0 or later, or apply the vendor’s patch, to stop the issue.
What to do
- Update omnispace agora project to version 26.10.0 or later.
Affected software
| Vendor | Product | Affected versions |
|---|---|---|
| omnispace | agora project | < 26.10.0 |
Original advisory text
Omnispace Agora Project < 26.10.0 Predictable Password-Reset Token Account Takeover
Omnispace Agora Project before 26.10.0 contains a predictable password-reset token vulnerability that allows unauthenticated attackers to take over user accounts by computing the reset token as sha1(login.password), a deterministic and reusable value. Attackers can derive or brute-force the reset token from known or guessed login and password combinations to forge valid password-reset requests and hijack arbitrary accounts.
Internet-facing
3 days
Internal
60 days
- Not known to be exploited
- Can be exploited automatically (estimated)
- Gives an attacker full control (estimated)
Type
CWE-640Weak Password Recovery Mechanism for Forgotten Password
Timeline
Published13 Oct 2026
Updated13 Oct 2026
First seen13 Oct 2026
Track software like this
Free during beta