CVE-2026-63159: Omnispace Agora Project < 26.10.0 Predictable Password-Reset Token Account Takeover
Omnispace Agora Project before 26.10.0 contains a predictable password-reset token vulnerability that allows unauthenticated attackers to take over user accounts by computing the reset token as sha1(login.password), a deterministic and reusable value. Attackers can derive or brute-force the reset token from known or guessed login and password combinations to forge valid password-reset requests and hijack arbitrary accounts.
Affected Software
Event History
Frequently Asked Questions
Does an attacker need an existing account or user interaction to exploit this issue?
No. The vulnerability is exploitable without privileges or user interaction, but the attacker must derive or guess a target login and password combination to compute the reset token.
What is the impact if exploitation succeeds?
An attacker can forge a valid password-reset request and take over an arbitrary user account. The assigned vector indicates high confidentiality and integrity impact, with no availability impact.
Which version addresses the issue?
The issue affects versions before 26.10.0. Upgrade to version 26.10.0 or later.