CVE-2026-63159

Deferred Deferred - Pending Action

Predictable Password Reset Token in Omnispace Agora Project

Publication date: 2026-10-13

Last updated on: 2026-10-15

Assigner: VulnCheck

Description

Omnispace Agora Project before 26.10.0 contains a predictable password-reset token vulnerability that allows unauthenticated attackers to take over user accounts by computing the reset token as sha1(login.password), a deterministic and reusable value. Attackers can derive or brute-force the reset token from known or guessed login and password combinations to forge valid password-reset requests and hijack arbitrary accounts.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-13

Last Modified

2026-10-15

Generated

2026-10-19

AI Q&A

2026-10-14

EPSS Evaluated

2026-10-18

NVD

CVE-2026-63159

EUVD

EUVD-2026-100565

Affected Vendors & Products

Vendor	Product	Version / Range
Omnispace	Agora	Project 0

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-640	The product contains a mechanism for users to recover or change their passwords without knowing the original password, but the mechanism is weak.

Attack-Flow Graph

Executive Summary

This vulnerability is a predictable password-reset token flaw in Omnispace Agora Project versions before 26.10.0. Reset tokens are generated using a deterministic SHA-1 hash of the user's login and password (sha1(login.password)), making tokens reusable and easy to compute. Attackers can derive or brute-force these tokens to forge password-reset requests and hijack user accounts without authentication.

Detection Guidance

To detect this vulnerability, inspect password-reset token generation logic in Omnispace Agora Project versions before 26.10.0. Check if reset tokens are generated using sha1(login.password). Review logs for unusual password-reset requests or account takeover attempts.

Impact Analysis

Unauthenticated attackers can take over any user account by computing the predictable reset token from known or guessed login and password combinations. This allows full account hijacking, unauthorized access to sensitive data, and potential control over user profiles or services relying on the affected system.

Compliance Impact

This vulnerability likely violates compliance requirements for data protection and access control, such as GDPR (data breach notification, integrity) and HIPAA (unauthorized access to protected health information). It undermines security controls requiring secure authentication and password reset mechanisms.

Mitigation Strategies

Upgrade Omnispace Agora Project to version 26.10.0 or later to address the predictable token flaw. Disable password-reset tokens based on sha1(login.password) and implement stronger, randomized token generation methods.

Hi! I’m here to help you understand CVE-2026-63159. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70