Insecure Token Storage Vulnerability in Omnispace Agora Project

CVE-2026-63160

What is CVE-2026-63160?

The Omnispace Agora Project contains a flaw in its handling of persistent remember-me tokens. Specifically, these tokens are stored on the server in plaintext form, directly mirroring the user's bearer credentials retained in their cookies. This oversight poses a risk where an attacker gaining unauthorized access to the stored tokens—through means such as database leaks or backup data exposure—can easily replay this information to authenticate as the affected user without needing to enter a password. It's critical for users of this software to upgrade to version 26.10.0 or later to secure their accounts against potential exploitation.

References