CVE-2026-63160

HighCVSS 7.4/10Last modified Oct 18, 2026

Description

Omnispace Agora Project before 26.10.0 contains a vulnerability where the persistent remember-me token is stored verbatim server-side, making the stored value identical to the bearer credential held in the user's cookie. Attackers who gain access to the stored token, such as through database or backup disclosure, can replay the plaintext value to authenticate as the victim user without needing their password.

Metrics

CVSS 3.1 7.4/10CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N

Weakness enumeration

CWE-522

Affected software

No affected versions have been published.

Timeline

Published
Oct 13, 2026
Last modified
Oct 18, 2026
NVD status
Deferred

Related CVEs from 2026

CVE-2026-631618.8Omnispace Agora Project before 26.10.0 contains a session fixation vulnerability that allows remote attackers to hijack authenticated sessioCVE-2026-631628.8Omnispace Agora Project before 26.10.0 contains a path traversal vulnerability that allows attackers to write arbitrary files outside the inCVE-2026-631637.5Omnispace Agora Project before 26.10.0 contains a broken access control vulnerability in the MobileFileDownload route that allows unauthentiCVE-2026-631658.1Omnispace Agora Project before 26.10.0 contains a SQL injection vulnerability in the calendar functionality that allows attackers to inject CVE-2026-631685.4Omnispace Agora Project before 26.10.0 contains a stored cross-site scripting vulnerability that allows authenticated attackers to persist uCVE-2026-631696.4Omnispace Agora Project before 26.10.0 contains a stored cross-site scripting vulnerability that allows authenticated users to post messagesCVE-2026-63178.8Use after free in Cast in Google Chrome prior to 147.0.7727.101 allowed a remote attacker to execute arbitrary code via a crafted HTML page.CVE-2026-631715.4Omnispace Agora Project before 26.10.0 contains a stored cross-site scripting vulnerability that allows authenticated attackers to inject maCVE-2026-631727.1Omnispace Agora Project before 26.10.0 contains a broken access control vulnerability that allows a regular, non-administrative member to crCVE-2026-631748.1Omnispace Agora Project before 26.10.0 contains a broken access control vulnerability that allows a space administrator to assign users intoCVE-2026-631757.1PlaywrightCapture stored capture-specific configuration and runtime data as mutable class-level variables rather than instance-level variablCVE-2026-631777.1Malcolm is a network traffic analysis tool suite. Prior to version 26.07.0, role-based access control enforced in the Nginx OpenResty Lua la
CVE-2026-63160: High severity, CVSS 7.4 | Vulnix