Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
9.1

Omnispace Agora Project lets stolen token grant access

CVE-2026-63160 · published today
Summary

The Omnispace Agora Project stores its "remember me" login token in the same exact form as the user’s browser cookie. If someone obtains a copy of the database or a backup, they can use that token to log in as the user without knowing the password. Apply the update released after version 26.10.0, change any existing passwords, and make sure database files are protected against unauthorized access.

Original advisory text
Omnispace Agora Project before 26.10.0 contains a vulnerability where the persistent remember-me token is stored verbatim server-side, making the stored value identical to the bearer credential hel...
Omnispace Agora Project before 26.10.0 contains a vulnerability where the persistent remember-me token is stored verbatim server-side, making the stored value identical to the bearer credential held in the user's cookie. Attackers who gain access to the stored token, such as through database or backup disclosure, can replay the plaintext value to authenticate as the victim user without needing their password.
References
Fix within
Internet-facing 3 days
Internal 60 days
  • Not known to be exploited
  • Can be exploited automatically (estimated)
  • Gives an attacker full control (estimated)
Severity
9.1 Critical
Type
CWE-522Insufficiently Protected Credentials
Timeline
Published13 Oct 2026
Updated13 Oct 2026
First seen13 Oct 2026
Sources
CVE-2026-63160 · NVD
Track software like this
Free during beta