Insecure Randomness in Omnispace Agora Project Causes Predictable Passwords

CVE-2026-63149

What is CVE-2026-63149?

The Omnispace Agora Project prior to version 26.10.0 is susceptible to an insecure randomness vulnerability that enables attackers to predict temporary or default passwords established by the Txt::defaultPassword() function. This is due to the reliance on PHP's uniqid() function, which generates values based on the server time in microseconds. If an attacker observes the account creation timing or approximates it, they can deduce the predictable password, potentially allowing them to seize control of the account before the legitimate user has a chance to log in.

References