CVE-2026-63156

Deferred Deferred - Pending Action

Reflected XSS in Omnispace Agora Project

Publication date: 2026-10-13

Last updated on: 2026-10-14

Assigner: VulnCheck

Description

Omnispace Agora Project before 26.10.0 contains a reflected cross-site scripting vulnerability that allows unauthenticated attackers to inject malicious HTML attributes by manipulating the visioUrl parameter, which was not routed through the URL-sanitizing branch of the parameter filter and was urldecoded after filtering. Attackers can craft a malicious URL containing the visioUrl parameter with an attribute breakout payload to execute arbitrary JavaScript in the victim's browser pre-authentication, with the issue fixed in version 26.10.0 via changes to app/Common/Req.php.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-13

Last Modified

2026-10-14

Generated

2026-10-19

AI Q&A

2026-10-14

EPSS Evaluated

2026-10-18

NVD

CVE-2026-63156

EUVD

EUVD-2026-100474

Affected Vendors & Products

Vendor	Product	Version / Range
Omnispace	Agora	Project 0

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-79	The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Attack-Flow Graph

Executive Summary

This vulnerability is a reflected cross-site scripting (XSS) flaw in Omnispace Agora Project before version 26.10.0. It allows unauthenticated attackers to inject malicious HTML attributes by manipulating the visioUrl parameter. The parameter bypasses URL sanitization, enabling execution of arbitrary JavaScript in a victim's browser before authentication.

Detection Guidance

Check if your Omnispace Agora Project version is below 26.10.0. Inspect web server logs for requests containing the visioUrl parameter with suspicious payloads. Manually test by appending visioUrl with HTML attribute breakout payloads to application URLs.

Impact Analysis

An attacker could trick users into clicking a malicious link, leading to unauthorized script execution. This may result in session hijacking, data theft, or defacement of the affected application. Since it occurs pre-authentication, even unauthenticated users are at risk.

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive data, violating GDPR's data protection requirements and HIPAA's safeguards for protected health information. Organizations may face compliance penalties if exploited.

Mitigation Strategies

Upgrade Omnispace Agora Project to version 26.10.0 or later. Implement strict input validation for the visioUrl parameter. Apply URL sanitization before processing to prevent attribute breakout payloads.

Hi! I’m here to help you understand CVE-2026-63156. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70