Omnispace Agora Project: Insecure storage of remember-me tokens
Summary
Omnispace Agora Project versions before 26.10.0 store the persistent remember-me token verbatim on the server. The stored value is identical to the bearer credential in the user's cookie. An attacker who obtains the stored token, for example from a database dump or backup, can replay it to log in as the victim without knowing the password.
Affected
- Omnispace Agora Project, all versions before 26.10.0
Fixed in
- Version 26.10.0 or later (per OSV and the CVE range). The release notes of 26.10 do not mention this fix, so the exact fix commit is unconfirmed.
Workaround
- No vendor workaround found.
- Restrict access to database dumps and backups.
- After upgrading, force a logout of all users or purge the remember-me token table, since existing tokens may remain valid (unconfirmed).
- Patch CVE-2026-63158 (legacy cookie authentication bypass) in the same update.
Exploitation
- No known exploitation in the wild.
- No public proof of concept found.
- CISA SSVC: exploitation none, not automatable, total technical impact.
- NVD status: Deferred.
Our recommendation
- Upgrade to Agora Project 26.10.0 or later.
- Purge or invalidate existing remember-me tokens and force a logout of all users after the upgrade.
- Restrict and encrypt database dumps and backups.
- Check whether the platform is internet-facing and prioritise it if it is.
- Monitor logins for unusual sessions from new locations or devices.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- GitHub release 26.10 (Agora Project) github.com
- Agora Project website www.agora-project.net
- VulnCheck advisory: Insecure remember-me token storage www.vulncheck.com
- OSV record CVE-2026-63160 osv.dev
- Vulners CVE list entry CVE-2026-63160 vulners.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 31 Oct 2026, 06:42.
Original description (NVD)
Omnispace Agora Project before 26.10.0 contains a vulnerability where the persistent remember-me token is stored verbatim server-side, making the stored value identical to the bearer credential held in the user's cookie. Attackers who gain access to the stored token, such as through database or backup disclosure, can replay the plaintext value to authenticate as the victim user without needing their password.
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.