CVE-2026-63151: Omnispace Agora Project 26.10.0 Predictable Token Information Disclosure via DisplayIcal
Omnispace Agora Project through 26.10.0 contains a predictable token generation vulnerability that allows unauthenticated attackers to access private calendar data by exploiting a missing dateCrea value that causes the md5Id token to collapse to md5(calendarId.userId), both small enumerable integers. Attackers can compute valid tokens and request the misc&action=DisplayIcal endpoint with a forged md5Id to read any user's private calendar events without authentication.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue?
Any unauthenticated remote attacker can exploit it. No account, privileges, or user interaction are required.
What information can an attacker access?
An attacker can read private calendar events belonging to any user by generating a valid md5Id value and requesting the misc&action=DisplayIcal endpoint.
Why are the tokens predictable?
When dateCrea is missing, the md5Id token is reduced to md5(calendarId.userId). Because calendarId and userId are small enumerable integers, attackers can calculate candidate tokens.
Which releases are identified as affected?
The issue is reported in Omnispace Agora Project through version 26.10.0.