Omnispace Agora Project: Account takeover via predictable password-reset token
Summary
Omnispace Agora Project before 26.10.0 generates password-reset tokens as sha1(login.password), a deterministic and reusable value. An unauthenticated remote attacker who knows or guesses a login and password combination can compute or brute-force the token, forge password-reset requests and take over arbitrary user accounts. The CVSS 4.0 vector rates attack complexity as high, so the real-world risk depends on credential exposure.
Affected
- Omnispace Agora Project versions 0 to before 26.10.0
- Default configuration is unaffected according to the CVE record
Fixed in
- Version 26.10.0 or later; the latest 26.10.x release is recommended (e.g. 26.10.5 as listed by Softaculous, to be confirmed on the GitHub releases page)
Workaround
- Unknown. No vendor workaround was found.
- Interim measures (not from a vendor source): restrict access to the login and password-reset pages, enable two-factor authentication where available, and review password-reset mails and login logs for unexpected activity.
Exploitation
- No confirmed exploitation in the wild.
- No confirmed public proof-of-concept exploit.
- CISA SSVC: exploitation none, automatable no, technical impact total.
Our recommendation
- Identify all Agora Project instances, especially internet-facing ones, and check their version.
- Update to the latest 26.10.x release as a high priority.
- Enable two-factor authentication and enforce strong, unique passwords.
- Review password-reset and login logs for unexpected activity.
- Patch the other CVEs in the same batch (CVE-2026-63158, CVE-2026-63160, CVE-2026-63161, CVE-2026-63149) together.
- If the instance is hosted by a provider, confirm that the provider applies the update.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- GitHub release 26.10 github.com
- VulnCheck advisory www.vulncheck.com
- Agora Project home page www.agora-project.net
- Softaculous update to 26.10.5 www.softaculous.com
- OSV entry CVE-2026-63159 osv.dev
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 31 Oct 2026, 06:41.
Original description (NVD)
Omnispace Agora Project before 26.10.0 contains a predictable password-reset token vulnerability that allows unauthenticated attackers to take over user accounts by computing the reset token as sha1(login.password), a deterministic and reusable value. Attackers can derive or brute-force the reset token from known or guessed login and password combinations to forge valid password-reset requests and hijack arbitrary accounts.
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.