Omnispace Agora-Project: Session fixation after authentication
Summary
Omnispace Agora-Project before 26.10.0 does not regenerate the session identifier after a successful login. A remote attacker who plants a known session ID in a victim's browser before login can take over the victim's authenticated session after the victim logs in. The CVSS v4 base score is 8.6, and exploitation requires the victim to take an action such as logging in with the planted session.
Affected
- Omnispace Agora-Project versions 0 up to, but not including, 26.10.0
Fixed in
- Version 26.10.0 (GitHub release of 1 October). Later 26.10.x builds exist; use the latest 26.10.x release.
- The release notes do not explicitly mention the session fix, so the specific code change could not be confirmed from vendor text.
Workaround
- No vendor-published workaround.
- Until patched, restrict access to the instance (VPN or IP allow-list).
- After upgrading, terminate all existing sessions so that pre-login session identifiers are no longer valid.
Exploitation
- No known exploitation in the wild found.
- CISA SSVC assessment: exploitation none, automatable no, technical impact total.
- No public proof of concept found for this CVE.
Our recommendation
- Upgrade to the latest 26.10.x release, with priority for internet-facing instances. Other CVEs in the same release batch are more serious.
- Terminate all active sessions after the upgrade.
- Check whether the instance is reachable from the internet and restrict access where possible.
- Enable 2FA as an additional measure, but note that it does not fix this issue on its own.
- Monitor logins for unusual session activity.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- GitHub release 26.10 github.com
- VulnCheck advisory: Session fixation via authentication www.vulncheck.com
- OSV entry CVE-2026-63161 osv.dev
- Vulners CVE-2026-63161 vulners.com
- Strix CVE-2026-63161 www.strix.ai
- Softaculous: Agora Project 26.10.0 update www.softaculous.com
- Softaculous: Agora Project 26.10.5 update www.softaculous.com
- Agora Project website www.agora-project.net
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 1 Nov 2026, 08:22.
Original description (NVD)
Omnispace Agora Project before 26.10.0 contains a session fixation vulnerability that allows remote attackers to hijack authenticated sessions by planting a known session identifier in a victim's browser prior to login. Attackers can exploit the application's failure to regenerate the session id upon successful authentication to gain unauthorized access to the victim's authenticated session after they log in.
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.