CVE-2026-63155
Omnispace Agora Project 26.10.0 Open Redirect via objUrl Parameter
CVSS Score
6.1
EPSS Score
0.0%
EPSS Percentile
0th
Omnispace Agora Project through 26.10.0 contains an open redirect vulnerability that allows remote attackers to redirect users to arbitrary external URLs by manipulating the objUrl parameter in Ctrl.php's redir() function. Attackers can craft login links with objUrl set to a malicious site, causing the application to issue an HTTP 302 redirect to that external URL, which can be abused for phishing and credential theft.
| CWE | CWE-601 |
| Vendor | omnispace |
| Product | agora project |
| Published | Nov 13, 2026 |
| Last Updated | Nov 13, 2026 |
Stay Ahead of the Next One
Get instant alerts for omnispace agora project
Be the first to know when new medium vulnerabilities affecting omnispace agora project are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
CVSS v3 Breakdown
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
Required
Scope
Changed
Confidentiality
Low
Integrity
Low
Availability
None
Affected Versions
Omnispace / Agora Project
0 ≤ 26.10.0
References
akailabs.fr: https://www.akailabs.fr/blog/multiple-vulnerabilities-in-agora-project-26-5-2#cve-2026-63155-open-redirect-and-reflected-xss-via-objurl agora-project.net: https://www.agora-project.net/ vulncheck.com: https://www.vulncheck.com/advisories/omnispace-agora-project-open-redirect-via-objurl-parameter
Credits
Geoffrey Robert of akailabs Valentin Holubec of akailabs