Reflected Cross-Site Scripting in Omnispace Agora Project
CVE-2026-63156

5.1MEDIUM

Key Information:

Vendor

Omnispace

Status
Agora Project
Vendor
CVE Published:
13 October 2026

What is CVE-2026-63156?

The Omnispace Agora Project contains a reflected cross-site scripting vulnerability that allows unauthenticated attackers to inject harmful HTML attributes by manipulating the visioUrl parameter. This parameter was not properly routed through the URL-sanitizing filters prior to version 26.10.0. Attackers can construct a malicious URL that includes this parameter, eventually leading to the execution of arbitrary JavaScript in the victim's browser before authentication. The vulnerability was addressed in version 26.10.0, which included significant changes to the filtering mechanism in app/Common/Req.php.

Affected Version(s)

Agora Project 0 < 26.10.0

References

https://github.com/xech/agora-project/releases/tag/26.10
release-notespatch
https://www.agora-project.net/
product
https://www.vulncheck.com/advisories/omnispace-agora-proj...
third-party-advisory

CVSS V4

Score:
5.1
Severity:
MEDIUM
Confidentiality:
None
Integrity:
None
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
Unknown

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Geoffrey Robert of akailabs
.