CVE-2026-63160
7.4HighPublished 13 Oct 2026 · NVD status: Deferred · AI triage by gemini-3.8-flash
- Attack vector
- Network
- Complexity
- High
- Privileges needed
- None
- User interaction
- None
- Impact
- High impact on confidentiality, integrity
- Weakness
- CWE-522
Impact
Attackers can impersonate users and hijack sessions by replaying raw remember-me tokens obtained from compromised database records or backups. They only need access to the stored token data to authenticate without passwords.
Root cause
The application stores persistent remember-me tokens server-side as plaintext instead of hashing them, directly matching the bearer cookie value.
Affected systems
Omnispace Agora Project versions before 26.10.0
CVSS v3.1 · CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N
Fix & remediation
Upgrade to Omnispace Agora Project version 26.10.0 or later. If patching immediately is not possible, restrict database and backup access or invalidate existing remember-me sessions.
AI-suggested. Run it in staging first and check it against the vendor advisory. Why?
NVD description
Omnispace Agora Project before 26.10.0 contains a vulnerability where the persistent remember-me token is stored verbatim server-side, making the stored value identical to the bearer credential held in the user's cookie. Attackers who gain access to the stored token, such as through database or backup disclosure, can replay the plaintext value to authenticate as the victim user without needing their password.