CVE-2026-63158
7.4HighPublished 13 Oct 2026 · NVD status: Deferred · AI triage by gemini-3.8-flash
- Attack vector
- Network
- Complexity
- High
- Privileges needed
- None
- User interaction
- None
- Impact
- High impact on confidentiality, integrity
- Weakness
- CWE-836
Impact
Attackers who obtain a user's stored bcrypt password hash can impersonate that user, including administrators, without cracking the password. Network access to the application and a previously leaked or exfiltrated hash are required.
Root cause
The legacy AGORAP_LOG and AGORAP_PASS cookie mechanism accepts the raw bcrypt password hash as a directly valid authentication credential.
Affected systems
Omnispace Agora Project versions before 26.10.0
CVSS v3.1 · CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N
Fix & remediation
Upgrade Omnispace Agora Project to version 26.10.0 or later. If upgrading immediately is not possible, restrict network access to the web interface or block requests containing the AGORAP_PASS cookie at the reverse proxy.
$ git -C /path/to/agora-project pull && git -C /path/to/agora-project checkout 26.10AI-suggested. Run it in staging first and check it against the vendor advisory. Why?
NVD description
Omnispace Agora Project before 26.10.0 contains an authentication bypass vulnerability that allows attackers possessing a user's stored bcrypt password hash to authenticate as that user without knowing the actual password, caused by the legacy AGORAP_LOG/AGORAP_PASS cookie mechanism treating the stored hash as a directly replayable bearer credential. Attackers can set the AGORAP_LOG/AGORAP_PASS cookies with a stolen password hash to impersonate any user, including administrators, and gain unauthorized access to the application.