CVE-2026-63161
8.8HighPublished 13 Oct 2026 · NVD status: Deferred · AI triage by gemini-3.8-flash
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- Required
- Impact
- Full C/I/A compromise
- Weakness
- CWE-384
Impact
Remote attackers can hijack user accounts and take full control of authenticated sessions. To pull this off, the attacker must plant a known session ID in the victim's browser before the victim logs in.
Root cause
The application fails to regenerate the session ID upon successful user authentication.
Affected systems
Omnispace Agora Project versions before 26.10.0
CVSS v3.1 · CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Fix & remediation
Upgrade to Omnispace Agora Project 26.10.0 or later. No interim configuration workaround is provided, so prioritize patching or restrict web access until upgraded.
AI-suggested. Run it in staging first and check it against the vendor advisory. Why?
NVD description
Omnispace Agora Project before 26.10.0 contains a session fixation vulnerability that allows remote attackers to hijack authenticated sessions by planting a known session identifier in a victim's browser prior to login. Attackers can exploit the application's failure to regenerate the session id upon successful authentication to gain unauthorized access to the victim's authenticated session after they log in.