CVE-2026-63150: Omnispace Agora Project 26.10.0 CSRF via Administrator Account Creation
Omnispace Agora Project through 26.10.0 contains a cross-site request forgery vulnerability that allows remote attackers to forge privileged actions such as administrator user creation by merging $GET and $POST parameters without requiring an anti-CSRF token. Attackers can craft a malicious link or auto-navigating page that issues a plain GET request, exploiting the lack of CSRF protection and SameSite=Lax cookie behavior on top-level navigations to create unauthorized administrator accounts.
Affected Software
Event History
Frequently Asked Questions
What does an attacker need to exploit this issue?
The attacker needs to induce a victim with an authenticated privileged session to follow a malicious link or load an auto-navigating page. The exploit can use a plain top-level GET request because the affected application accepts merged GET and POST parameters without an anti-CSRF token.
Are default browser cookie protections enough to prevent exploitation?
No. The issue specifically relies on SameSite=Lax cookie behavior, which permits cookies on top-level navigations such as a victim following a crafted link. An anti-CSRF token is required to distinguish legitimate privileged requests from forged ones.
What actions can be forged?
The reported impact includes creation of unauthorized administrator accounts. The description also indicates that other privileged actions may be forgeable where they rely on the same merged GET/POST parameter handling and lack CSRF validation.
What can be done if an update cannot be applied immediately?
No workaround is provided in the available data. Prioritize restricting access to administrator sessions and avoid following untrusted links while a fix is being assessed or deployed.