CVE-2026-63149

Deferred Deferred - Pending Action

Insecure Randomness in Omnispace Agora Project Leading to Predictable Passwords

Publication date: 2026-10-13

Last updated on: 2026-10-14

Assigner: VulnCheck

Description

Omnispace Agora Project before 26.10.0 contains an insecure randomness vulnerability that allows attackers to predict temporary or default account passwords generated by Txt::defaultPassword() using PHP's uniqid() function based on server time in microseconds. Attackers who observe or approximate the account creation time can compute the predictable password and take over the account before the legitimate user logs in.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-13

Last Modified

2026-10-14

Generated

2026-10-19

AI Q&A

2026-10-14

EPSS Evaluated

2026-10-18

NVD

CVE-2026-63149

EUVD

EUVD-2026-100563

Affected Vendors & Products

Vendor	Product	Version / Range
Omnispace	Agora	Project 0

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-330	The product uses insufficiently random numbers or values in a security context that depends on unpredictable numbers.

Attack-Flow Graph

Executive Summary

This vulnerability involves the Omnispace Agora Project versions before 26.10.0 using PHP's uniqid() function to generate temporary or default account passwords. The function relies on server time in microseconds, making passwords predictable if the account creation time is known or approximated. Attackers can compute these passwords and take over accounts before legitimate users log in.

Detection Guidance

To detect this vulnerability, check if your Omnispace Agora Project version is before 26.10.0. Review account creation logs for default password generation using PHP's uniqid() function. Monitor for unusual login attempts or account takeovers.

Impact Analysis

If you use Omnispace Agora Project versions before 26.10.0, attackers could predict and use default passwords to gain unauthorized access to your accounts. This could lead to data theft, account takeover, or other malicious activities before you notice and change the password.

Compliance Impact

This vulnerability could lead to unauthorized account access, potentially violating data protection requirements under GDPR and HIPAA. Predictable passwords may result in unauthorized access to personal or health data, triggering compliance breaches for confidentiality and integrity.

Mitigation Strategies

Immediately upgrade Omnispace Agora Project to version 26.10.0 or later. Disable default password generation if possible. Implement stronger random password generation methods. Audit all accounts for unauthorized access.

Hi! I’m here to help you understand CVE-2026-63149. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70