CVE-2026-63160
CRITICAL
INFO
Priority: 0.03
BB Relevance:
78/100
Published: 2026-10-13
Modified: 2026-10-27
First seen: 2026-10-29
Status: active
Attack Surface
Network
Low Complexity
No Auth
No Interaction
Conf. Impact
Integ. Impact
CVSS Vector Breakdown
AV:
Network
AC:
High
PR:
None
UI:
None
AT:
None
VC:
High
VI:
High
VA:
None
Description
Omnispace Agora Project before 26.10.0 contains a vulnerability where the persistent remember-me token is stored verbatim server-side, making the stored value identical to the bearer credential held in the user's cookie. Attackers who gain access to the stored token, such as through database or backup disclosure, can replay the plaintext value to authenticate as the victim user without needing their password.