CVE-2026-63160: Omnispace Agora Project < 26.10.0 Insecure Remember-Me Token Storage
Omnispace Agora Project before 26.10.0 contains a vulnerability where the persistent remember-me token is stored verbatim server-side, making the stored value identical to the bearer credential held in the user's cookie. Attackers who gain access to the stored token, such as through database or backup disclosure, can replay the plaintext value to authenticate as the victim user without needing their password.
Affected Software
Event History
Frequently Asked Questions
Who is exposed to token replay attacks?
Users with persistent remember-me tokens are exposed if an attacker obtains the corresponding server-side stored token, such as through a database or backup disclosure. The attacker can authenticate as the affected user by replaying that token.
Does an attacker need the victim's password or an existing account to exploit this issue?
No. An attacker does not need the victim's password if they have obtained the stored remember-me token, because it is identical to the bearer credential in the user's cookie.
What versions are affected?
Omnispace Agora Project versions before 26.10.0 are affected.