Omnispace Agora Project: Predictable default password via uniqid()
Summary
Omnispace Agora Project before 26.10.0 generates temporary or default account passwords with PHP's uniqid() function, which is based on server time in microseconds. An attacker who knows or can closely estimate the account creation time can compute the password and take over the account before the legitimate user logs in. The CVSS v4.0 score is 9.1 (critical), but exploitation requires high attack complexity because the timing must be guessed precisely.
Affected
- Omnispace Agora Project versions 0 to before 26.10.0
- Default configuration is unaffected according to the CVE record
Fixed in
- Upgrade to Omnispace Agora Project 26.10.0 or later (release tag 26.10)
Workaround
Unknown.
Exploitation
- No evidence of exploitation in the wild found in the sources; status unknown
- No public proof-of-concept found
- CISA SSVC: exploitation none, automatable no, technical impact total
Our recommendation
- Upgrade all Agora Project instances to 26.10.0 or later; this release also covers several related CVEs published the same day
- Prioritise internet-facing instances
- Until the upgrade is done, check for recently created accounts with temporary passwords and force a password change on first login
- Deliver temporary passwords out of band and restrict who can create accounts
- Monitor logins to newly created accounts for suspicious activity
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- Vendor release 26.10 (GitHub) github.com
- VulnCheck advisory www.vulncheck.com
- Agora Project website www.agora-project.net
- OSV record CVE-2026-63149 osv.dev
- Vulners CVE record CVE-2026-63149 vulners.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 31 Oct 2026, 06:42.
Original description (NVD)
Omnispace Agora Project before 26.10.0 contains an insecure randomness vulnerability that allows attackers to predict temporary or default account passwords generated by Txt::defaultPassword() using PHP's uniqid() function based on server time in microseconds. Attackers who observe or approximate the account creation time can compute the predictable password and take over the account before the legitimate user logs in.
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.