CVE-2026-63160

Deferred Deferred - Pending Action

Omnispace Agora Project Persistent Token Authentication Bypass

Publication date: 2026-10-13

Last updated on: 2026-10-18

Assigner: VulnCheck

Description

Omnispace Agora Project before 26.10.0 contains a vulnerability where the persistent remember-me token is stored verbatim server-side, making the stored value identical to the bearer credential held in the user's cookie. Attackers who gain access to the stored token, such as through database or backup disclosure, can replay the plaintext value to authenticate as the victim user without needing their password.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-13

Last Modified

2026-10-18

Generated

2026-10-19

AI Q&A

2026-10-14

EPSS Evaluated

2026-10-18

NVD

CVE-2026-63160

EUVD

EUVD-2026-100566

Affected Vendors & Products

Vendor	Product	Version / Range
Omnispace	Agora	Project 0

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-522	The product transmits or stores authentication credentials, but it uses an insecure method that is susceptible to unauthorized interception and/or retrieval.

Attack-Flow Graph

Executive Summary

The vulnerability in Omnispace Agora Project before version 26.10.0 involves the insecure storage of remember-me tokens. These tokens are saved in plaintext on the server side, identical to the user's authentication cookie. If attackers access the database or backups, they can replay the plaintext token to authenticate as the victim without needing the password.

Detection Guidance

To detect this vulnerability, inspect server-side storage for remember-me tokens stored in plaintext. Check database tables or backup files where authentication tokens are stored. Look for tokens matching user cookies. Compare stored tokens with active session cookies to identify mismatches or plaintext storage.

Impact Analysis

Attackers gaining access to stored tokens can impersonate users, leading to unauthorized account access, data theft, or fraud. Users of affected versions risk account compromise if database or backup security is breached.

Compliance Impact

This vulnerability likely violates data protection requirements under GDPR and HIPAA due to insufficient credential protection. It risks unauthorized access to personal data, potentially leading to non-compliance with privacy and security standards.

Mitigation Strategies

Upgrade Omnispace Agora Project to version 26.10.0 or later immediately. Review and rotate all remember-me tokens in use. Ensure tokens are stored securely with strong encryption or hashing. Audit database and backup files for exposed tokens and revoke compromised ones.

Hi! I’m here to help you understand CVE-2026-63160. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70