CVE-2026-63160

critical

Description

Omnispace Agora Project before 26.10.0 contains a vulnerability where the persistent remember-me token is stored verbatim server-side, making the stored value identical to the bearer credential held in the user's cookie. Attackers who gain access to the stored token, such as through database or backup disclosure, can replay the plaintext value to authenticate as the victim user without needing their password.

References

https://www.vulncheck.com/advisories/omnispace-agora-project-insecure-remember-me-token-storage

https://www.agora-project.net/

https://github.com/xech/agora-project/releases/tag/26.10

https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-100566

Details

Source: Mitre, NVD

Published: 2026-10-13

Updated: 2026-10-18

Risk Information

CVSS v2

Base Score: 7.1

Vector: CVSS2#AV:N/AC:H/Au:N/C:C/I:C/A:N

Severity: High

CVSS v3

Base Score: 7.4

Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N

Severity: High

CVSS v4

Base Score: 9.1

Vector: CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N

Severity: Critical

EPSS

EPSS: 0.00328