Omnispace Agora Project: Authentication bypass via stored password hash cookies
Summary
Omnispace Agora Project versions before 26.10.0 contain an authentication bypass. The legacy AGORAP_LOG/AGORAP_PASS cookie mechanism accepts the stored bcrypt password hash as a directly replayable credential. An attacker who obtains a user's password hash can set these cookies and log in as that user, including administrators, without knowing the actual password. The CNA rates the issue CVSS 9.1 (v4.0), while the NVD status is Deferred.
Affected
- Omnispace Agora Project before 26.10.0 (CNA record: affected 0 to < 26.10.0)
- Some trackers list narrower or different version ranges; these were not verified against the vendor.
Fixed in
- Upgrade to Agora Project 26.10.0 or later (CNA and VulnCheck reference 26.10.0 as the fixed version).
- The vendor release notes for tag 26.10 do not explicitly name this authentication fix.
Workaround
Unknown. No vendor-documented workaround was found. Upgrading to 26.10.0 is the remediation.
Exploitation
- No primary-source evidence of in-the-wild exploitation was found. One tracker claims exploitation attempts were detected, but names no source.
- Public exploit code: sources conflict. Some trackers report none; the VulnCheck advisory may contain PoC content that could not be verified.
- CISA SSVC: exploitation none, automatable no, technical impact partial.
Our recommendation
- Upgrade all Agora Project instances to 26.10.0 or later.
- After upgrading, force password resets for all users, especially administrators, because previously stored hashes may have leaked.
- Verify that old AGORAP_LOG/AGORAP_PASS cookies no longer grant access after the upgrade.
- Review web server logs for requests carrying these cookie names.
- Restrict administrative access to trusted networks where feasible.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- VulnCheck advisory: Omnispace Agora Project Pass-the-Hash Authentication Bypass via Cookies www.vulncheck.com
- Agora Project GitHub release 26.10 github.com
- Agora Project vendor website www.agora-project.net
- OSV: CVE-2026-63158 osv.dev
- VulDB entry 418108 vuldb.com
- devguard vulnerability database: CVE-2026-63158 docs.devguard.org
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 31 Oct 2026, 06:41.
Original description (NVD)
Omnispace Agora Project before 26.10.0 contains an authentication bypass vulnerability that allows attackers possessing a user's stored bcrypt password hash to authenticate as that user without knowing the actual password, caused by the legacy AGORAP_LOG/AGORAP_PASS cookie mechanism treating the stored hash as a directly replayable bearer credential. Attackers can set the AGORAP_LOG/AGORAP_PASS cookies with a stolen password hash to impersonate any user, including administrators, and gain unauthorized access to the application.
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.