CVE-2026-63161: Omnispace Agora Project < 26.10.0 Session Fixation via Authentication
Omnispace Agora Project before 26.10.0 contains a session fixation vulnerability that allows remote attackers to hijack authenticated sessions by planting a known session identifier in a victim's browser prior to login. Attackers can exploit the application's failure to regenerate the session id upon successful authentication to gain unauthorized access to the victim's authenticated session after they log in.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Omnispace Agora Projectto a version that resolves this vulnerability.Fixed in 26.10.0
Event History
Frequently Asked Questions
Who is exposed to this issue?
Deployments of Omnispace Agora Project before 26.10.0 are affected. A victim must authenticate after an attacker has planted a session identifier in that victim's browser.
What does an attacker need to exploit the vulnerability?
The attacker needs to set or otherwise plant a session identifier they know in the victim's browser before the victim logs in. No attacker authentication is required, but victim interaction is required because the victim must log in using that session.
How can I determine whether my deployment is affected?
Check the deployed Omnispace Agora Project version. Versions before 26.10.0 are affected; version 26.10.0 is identified as the release boundary for this issue.
What is the remediation?
Upgrade Omnispace Agora Project to 26.10.0 or later. The issue is caused by failure to regenerate the session identifier after successful authentication, so remediation must ensure session IDs are regenerated at login.