CVE-2026-63158: Omnispace Agora Project < 26.10.0 Pass-the-Hash Authentication Bypass via Cookies

Q: Can this be exploited remotely without an existing account or user interaction?

The CVSS vector indicates network-based exploitation with no privileges required and no user interaction required. Exploitation is rated high complexity.

Q: What is the expected security impact if exploitation succeeds?

The issue is rated high severity with a 7.4 score. It has high confidentiality and integrity impact, while availability impact is rated none.

Published Oct 13, 2026

Updated

Omnispace Agora Project before 26.10.0 contains an authentication bypass vulnerability that allows attackers possessing a user's stored bcrypt password hash to authenticate as that user without knowing the actual password, caused by the legacy AGORAPLOG/AGORAPPASS cookie mechanism treating the stored hash as a directly replayable bearer credential. Attackers can set the AGORAPLOG/AGORAPPASS cookies with a stolen password hash to impersonate any user, including administrators, and gain unauthorized access to the application.

Affected Software

1 affected component

Omnispace Agora Project<26.10.0

Event History

Oct 13, 2026

CVE Published

via MITRE·07:45 PM

Data Sourced

via MITRE·07:45 PM

DescriptionSeverityWeakness

Frequently Asked Questions

Can this be exploited remotely without an existing account or user interaction?

The CVSS vector indicates network-based exploitation with no privileges required and no user interaction required. Exploitation is rated high complexity.

What is the expected security impact if exploitation succeeds?