CVE-2026-63160

HIGH 7.4

Omnispace Agora Project < 26.10.0 Insecure Remember-Me Token Storage

CVSS Score

7.4

EPSS Score

0.0%

EPSS Percentile

0th

Omnispace Agora Project before 26.10.0 contains a vulnerability where the persistent remember-me token is stored verbatim server-side, making the stored value identical to the bearer credential held in the user's cookie. Attackers who gain access to the stored token, such as through database or backup disclosure, can replay the plaintext value to authenticate as the victim user without needing their password.

CWE	CWE-522
Vendor	omnispace
Product	agora project
Published	Oct 13, 2026

Stay Ahead of the Next One

Get instant alerts for omnispace agora project

Be the first to know when new high vulnerabilities affecting omnispace agora project are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

CVSS v3 Breakdown

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

None

Affected Versions

Omnispace / Agora Project

0 < 26.10.0

References

NVD ↗ CVE.org ↗ EPSS Data ↗

github.com: https://github.com/xech/agora-project/releases/tag/26.10 agora-project.net: https://www.agora-project.net/ vulncheck.com: https://www.vulncheck.com/advisories/omnispace-agora-project-insecure-remember-me-token-storage

Credits

Geoffrey Robert of akailabs