CVE-2026-63156: Omnispace Agora Project < 26.10.0 Reflected XSS via visioUrl Parameter
Omnispace Agora Project before 26.10.0 contains a reflected cross-site scripting vulnerability that allows unauthenticated attackers to inject malicious HTML attributes by manipulating the visioUrl parameter, which was not routed through the URL-sanitizing branch of the parameter filter and was urldecoded after filtering. Attackers can craft a malicious URL containing the visioUrl parameter with an attribute breakout payload to execute arbitrary JavaScript in the victim's browser pre-authentication, with the issue fixed in version 26.10.0 via changes to app/Common/Req.php.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Omnispace Agora Projectto a version that resolves this vulnerability.Fixed in 26.10.0
Event History
Frequently Asked Questions
Who can exploit this issue, and what must they do?
An unauthenticated attacker can craft a malicious URL containing the visioUrl parameter and induce a victim to open it. Exploitation requires victim interaction, after which arbitrary JavaScript can run in that victim's browser before authentication.
Are deployments affected by default?
The issue is in handling of the visioUrl request parameter, which was not sent through the URL-sanitizing branch and was URL-decoded after filtering. Any deployment running a version before 26.10.0 is affected when a victim visits a crafted URL containing that parameter.
What should be done if patching cannot happen immediately?
The provided data identifies version 26.10.0 as the fix. Until it is deployed, avoid exposing or following untrusted Agora Project URLs that include the visioUrl parameter, since exploitation depends on a victim opening an attacker-crafted link.