CVE-2026-63161

HighCVSS 8.8/10Last modified Oct 15, 2026

Description

Omnispace Agora Project before 26.10.0 contains a session fixation vulnerability that allows remote attackers to hijack authenticated sessions by planting a known session identifier in a victim's browser prior to login. Attackers can exploit the application's failure to regenerate the session id upon successful authentication to gain unauthorized access to the victim's authenticated session after they log in.

Metrics

CVSS 3.1 8.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-384

Affected software

No affected versions have been published.

Timeline

Published
Oct 13, 2026
Last modified
Oct 15, 2026
NVD status
Deferred

Related CVEs from 2026

CVE-2026-631628.8Omnispace Agora Project before 26.10.0 contains a path traversal vulnerability that allows attackers to write arbitrary files outside the inCVE-2026-631637.5Omnispace Agora Project before 26.10.0 contains a broken access control vulnerability in the MobileFileDownload route that allows unauthentiCVE-2026-631658.1Omnispace Agora Project before 26.10.0 contains a SQL injection vulnerability in the calendar functionality that allows attackers to inject CVE-2026-631685.4Omnispace Agora Project before 26.10.0 contains a stored cross-site scripting vulnerability that allows authenticated attackers to persist uCVE-2026-631696.4Omnispace Agora Project before 26.10.0 contains a stored cross-site scripting vulnerability that allows authenticated users to post messagesCVE-2026-63178.8Use after free in Cast in Google Chrome prior to 147.0.7727.101 allowed a remote attacker to execute arbitrary code via a crafted HTML page.CVE-2026-631715.4Omnispace Agora Project before 26.10.0 contains a stored cross-site scripting vulnerability that allows authenticated attackers to inject maCVE-2026-631727.1Omnispace Agora Project before 26.10.0 contains a broken access control vulnerability that allows a regular, non-administrative member to crCVE-2026-631748.1Omnispace Agora Project before 26.10.0 contains a broken access control vulnerability that allows a space administrator to assign users intoCVE-2026-631757.1PlaywrightCapture stored capture-specific configuration and runtime data as mutable class-level variables rather than instance-level variablCVE-2026-631777.1Malcolm is a network traffic analysis tool suite. Prior to version 26.07.0, role-based access control enforced in the Nginx OpenResty Lua laCVE-2026-631786.5Onyx is an open-source AI platform. Prior to 4.3.0, Onyx Enterprise Edition's PATCH /manage/admin/user-group/{user_group_id} and POST /manag
CVE-2026-63161: High severity, CVSS 8.8 | Vulnix