Authentication Bypass Vulnerability in Omnispace Agora Project
CVE-2026-63158

9.1CRITICAL

Key Information:

Vendor

Omnispace

Status
Agora Project
Vendor
CVE Published:
13 October 2026

What is CVE-2026-63158?

The Omnispace Agora Project prior to version 26.10.0 suffers from an authentication bypass vulnerability. This flaw allows attackers to authenticate as any user, including administrators, by exploiting the legacy cookie mechanism that treats stored bcrypt password hashes as reusable credentials. By setting the AGORAP_LOG and AGORAP_PASS cookies with a compromised password hash, an attacker can gain unauthorized access to the application and potentially take control over user sessions.

Affected Version(s)

Agora Project 0 < 26.10.0

References

https://github.com/xech/agora-project/releases/tag/26.10
release-notespatch
https://www.agora-project.net/
product
https://www.vulncheck.com/advisories/omnispace-agora-proj...
third-party-advisory

CVSS V4

Score:
9.1
Severity:
CRITICAL
Confidentiality:
High
Integrity:
High
Availability:
None
Attack Vector:
Network
Attack Complexity:
High
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Geoffrey Robert of akailabs
.