CVE-2026-63149: Omnispace Agora Project < 26.10.0 Predictable Default Password via uniqid()
Omnispace Agora Project before 26.10.0 contains an insecure randomness vulnerability that allows attackers to predict temporary or default account passwords generated by Txt::defaultPassword() using PHP's uniqid() function based on server time in microseconds. Attackers who observe or approximate the account creation time can compute the predictable password and take over the account before the legitimate user logs in.
Affected Software
Event History
Frequently Asked Questions
Who is exposed to account takeover?
Accounts whose temporary or default passwords were generated by Txt::defaultPassword() in affected versions are exposed, particularly during the period before the legitimate user first logs in.
What does an attacker need to exploit this issue?
An attacker needs to observe or approximate the account creation time. They can use the server time in microseconds as the basis for predicting passwords generated with PHP's uniqid().
Are credentials created after upgrading still affected?
The issue affects Omnispace Agora Project versions before 26.10.0. Upgrading to version 26.10.0 or later addresses the vulnerable password-generation behavior for newly generated passwords.
What should be done for accounts created before remediation?
Reset temporary or default passwords for accounts that may have been created with the affected password generator, especially accounts that had not yet been used by their intended users.