Session Fixation Vulnerability in Omnispace Agora Project by Omnispace

CVE-2026-63161

What is CVE-2026-63161?

The Omnispace Agora Project versions prior to 26.10.0 are vulnerable to session fixation attacks. This occurs when remote attackers can manipulate session identifiers stored in a victim's browser before they log in. Due to the application not regenerating the session ID upon successful authentication, attackers can exploit this vulnerability to take over authenticated sessions, allowing them unauthorized access to the victim's account. It is crucial to update to the fixed version to mitigate this risk.

References