CVE-2026-63159
7.4HighPublished 13 Oct 2026 · NVD status: Deferred · AI triage by gemini-3.8-flash
- Attack vector
- Network
- Complexity
- High
- Privileges needed
- None
- User interaction
- None
- Impact
- High impact on confidentiality, integrity
- Weakness
- CWE-640
Impact
Unauthenticated remote attackers can take over arbitrary user accounts by forging password-reset requests. They only need network access to the Agora Project instance and the ability to guess or derive target credentials.
Root cause
Password-reset tokens are generated deterministically and reusably using sha1(login.password) instead of a secure, cryptographically random value.
Affected systems
Omnispace Agora Project versions prior to 26.10.0
CVSS v3.1 · CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N
Fix & remediation
Upgrade Omnispace Agora Project to version 26.10.0 or later. If patching immediately is not possible, disable the password reset feature or restrict network access to the application.
AI-suggested. Run it in staging first and check it against the vendor advisory. Why?
NVD description
Omnispace Agora Project before 26.10.0 contains a predictable password-reset token vulnerability that allows unauthenticated attackers to take over user accounts by computing the reset token as sha1(login.password), a deterministic and reusable value. Attackers can derive or brute-force the reset token from known or guessed login and password combinations to forge valid password-reset requests and hijack arbitrary accounts.