Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%

Buy Us a Coffee

CVE-2026-63149— Omnispace Agora Project < 26.10.0 Predictable Default Password via uniqid()

Quick assessment

Affected

Omnispace Agora Project

Exploitation

No confirmed in-the-wild exploitation; assess based on exposure

Recommended action

Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

Omnispace Agora Project 在 26.10.0 版本之前存在一个不安全的随机性漏洞，攻击者可以利用基于服务器微秒级时间的 PHP 函数，预测由生成的临时或默认账户密码。攻击者若能观察或近似推断出账户的创建时间，便可计算出可预测的密码，并在合法用户登录之前接管该账户。

CVSS 7.4 · High EPSS 0.36% · P29 Updated Oct 15, 2026

Possible ATT&CK Techniques 2 AI

T1098 · Account Manipulation T1078 · Valid Accounts

Affected Version Matrix 1

Vendor	Product	Version Range	Status
Omnispace	Agora Project	`< 26.10.0`	affected

Get alerts for future matching vulnerabilities Log in to subscribe

Vulnerability Information

Have questions about the vulnerability? See if Shenlong's analysis helps!

View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title

Omnispace Agora Project < 26.10.0 Predictable Default Password via uniqid()

Source: CVE Program / CVE List V5

Vulnerability Description

Omnispace Agora Project before 26.10.0 contains an insecure randomness vulnerability that allows attackers to predict temporary or default account passwords generated by Txt::defaultPassword() using PHP's uniqid() function based on server time in microseconds. Attackers who observe or approximate the account creation time can compute the predictable password and take over the account before the legitimate user logs in.

Source: CVE Program / CVE List V5

CVSS Information

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N

Source: CVE Program / CVE List V5

Vulnerability Type

使用不充分的随机数

Source: CVE Program / CVE List V5

Affected Products

Vendor	Product	Affected Versions	CPE	Subscribe
Omnispace	Agora Project	0 ~ 26.10.0	-

II. Public POCs for CVE-2026-63149

#	POC Description	Source Link	Shenlong Link

AI-Generated POC Premium

No public POC found.

III. Intelligence Information for CVE-2026-63149

请登录查看更多情报信息。

Same Patch Batch · Omnispace · 2026-10-13 · 21 CVEs total

CVE-2026-63146	9.8 CRITICAL	Omnispace Agora Project < 26.10.0 PHP Code Injection via config.inc.php
CVE-2026-63161	8.8 HIGH	Omnispace Agora Project < 26.10.0 Session Fixation via Authentication
CVE-2026-63154	8.8 HIGH	Omnispace Agora Project < 26.10.0 SQL Identifier Injection via agoraFields[]
CVE-2026-63162	8.8 HIGH	Omnispace Agora Project < 26.10.0 Path Traversal via tmpFolderName Parameter
CVE-2026-63174	8.1 HIGH	Omnispace Agora Project < 26.10.0 Broken Access Control via spaceAffectList
CVE-2026-63153	8.1 HIGH	Omnispace Agora Project < 26.10.0 Broken Access Control via setAffectations()
CVE-2026-63152	8.1 HIGH	Omnispace Agora Project < 26.10.0 Second-Order SQL Injection via _idCategoryFilter
CVE-2026-63165	8.1 HIGH	Omnispace Agora Project < 26.10.0 SQL Injection via sortEvents Parameter
CVE-2026-63163	7.5 HIGH	Omnispace Agora Project < 26.10.0 Broken Access Control via MobileFileDownload
CVE-2026-63158	7.4 HIGH	Omnispace Agora Project < 26.10.0 Pass-the-Hash Authentication Bypass via Cookies
CVE-2026-63160	7.4 HIGH	Omnispace Agora Project < 26.10.0 Insecure Remember-Me Token Storage
CVE-2026-63159	7.4 HIGH	Omnispace Agora Project < 26.10.0 Predictable Password-Reset Token Account Takeover
CVE-2026-63172	7.1 HIGH	Omnispace Agora Project < 26.10.0 Broken Function-Level Authorization via User-Edit
CVE-2026-63169	6.4 MEDIUM	Omnispace Agora Project < 26.10.0 Stored XSS via Messenger Iframe
CVE-2026-63156	6.1 MEDIUM	Omnispace Agora Project < 26.10.0 Reflected XSS via visioUrl Parameter
CVE-2026-63147	5.4 MEDIUM	Omnispace Agora Project < 26.10.0 Stored XSS via Uploaded File Name
CVE-2026-63148	5.4 MEDIUM	Omnispace Agora Project < 26.10.0 Stored XSS via Poll-Response Attachment Filename
CVE-2026-63168	5.4 MEDIUM	Omnispace Agora Project < 26.10.0 Stored XSS via Nested POST Array Bypass
CVE-2026-63171	5.4 MEDIUM	Omnispace Agora Project < 26.10.0 Stored XSS via Category Description
CVE-2026-63157	5.4 MEDIUM	Omnispace Agora Project < 26.10.0 Stored XSS via Links Module

IV. Related Vulnerabilities

Same product: Agora Project

Same vendor: Omnispace

Same weakness: CWE-330

V. Comments for CVE-2026-63149

No comments yet

Goal Reached Thanks to every supporter — we hit 100%!

CVE-2026-63149— Omnispace Agora Project < 26.10.0 Predictable Default Password via uniqid()

Quick assessment

Possible ATT&CK Techniques 2 AI

Affected Version Matrix 1

I. Basic Information for CVE-2026-63149

Vulnerability Information

Vulnerability Title

Vulnerability Description

CVSS Information

Vulnerability Type

Affected Products

II. Public POCs for CVE-2026-63149

III. Intelligence Information for CVE-2026-63149

Patches & Fixes for CVE-2026-63149 (1)

Vendor Advisories for CVE-2026-63149 (1)

Vendor Pages for CVE-2026-63149 (1)

Same Patch Batch · Omnispace · 2026-10-13 · 21 CVEs total

IV. Related Vulnerabilities

V. Comments for CVE-2026-63149

Leave a comment