CVE-2026-63149
7.4HighPublished 13 Oct 2026 · NVD status: Deferred · AI triage by gemini-3.8-flash
- Attack vector
- Network
- Complexity
- High
- Privileges needed
- None
- User interaction
- None
- Impact
- High impact on confidentiality, integrity
- Weakness
- CWE-330
Impact
Remote unauthenticated attackers can take over newly created accounts before legitimate users log in. They only need network access and the ability to approximate the account creation timestamp.
Root cause
The application generates default and temporary passwords via PHP's uniqid() based purely on server microsecond timestamps instead of a cryptographically secure random source.
Affected systems
Omnispace Agora Project versions before 26.10.0
CVSS v3.1 · CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N
Fix & remediation
Upgrade Omnispace Agora Project to version 26.10.0 or later; if patching immediately is not possible, avoid using auto-generated default passwords or force immediate manual password resets.
AI-suggested. Run it in staging first and check it against the vendor advisory. Why?
NVD description
Omnispace Agora Project before 26.10.0 contains an insecure randomness vulnerability that allows attackers to predict temporary or default account passwords generated by Txt::defaultPassword() using PHP's uniqid() function based on server time in microseconds. Attackers who observe or approximate the account creation time can compute the predictable password and take over the account before the legitimate user logs in.