Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%

Buy Us a Coffee

CVE-2026-63158— Omnispace Agora Project < 26.10.0 Pass-the-Hash Authentication Bypass via Cookies

Quick assessment

Affected

Omnispace Agora Project

Exploitation

No confirmed in-the-wild exploitation; assess based on exposure

Recommended action

Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

在 Omnispace Agora Project 26.10.0 之前的版本中存在一个身份验证绕过漏洞。攻击者只要拥有用户存储的 bcrypt 密码哈希值，即可在不了解实际密码的情况下以该用户身份进行身份验证。该漏洞是由遗留的 AGORAP_LOG/AGORAP_PASS cookie 机制导致的，该机制将存储的密码哈希直接作为可重放的承载型凭据（bearer credential）使用。攻击者可以通过设置 AGORAP_LOG/AGORAP_PASS cookie，使用窃取的密码哈希来冒充任何用户（包括管理员）

CVSS 7.4 · High EPSS 0.41% · P34 Updated Oct 15, 2026

Possible ATT&CK Techniques 2 AI

T1078 · Valid Accounts T1199 · Trusted Relationship

Affected Version Matrix 1

Vendor	Product	Version Range	Status
Omnispace	Agora Project	`< 26.10.0`	affected

Get alerts for future matching vulnerabilities Log in to subscribe

Vulnerability Information

Have questions about the vulnerability? See if Shenlong's analysis helps!

View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title

Omnispace Agora Project < 26.10.0 Pass-the-Hash Authentication Bypass via Cookies

Source: CVE Program / CVE List V5

Vulnerability Description

Omnispace Agora Project before 26.10.0 contains an authentication bypass vulnerability that allows attackers possessing a user's stored bcrypt password hash to authenticate as that user without knowing the actual password, caused by the legacy AGORAP_LOG/AGORAP_PASS cookie mechanism treating the stored hash as a directly replayable bearer credential. Attackers can set the AGORAP_LOG/AGORAP_PASS cookies with a stolen password hash to impersonate any user, including administrators, and gain unauthorized access to the application.

Source: CVE Program / CVE List V5

CVSS Information

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N

Source: CVE Program / CVE List V5

Vulnerability Type

在认证机制中使用口令哈希代替口令

Source: CVE Program / CVE List V5

Affected Products

Vendor	Product	Affected Versions	CPE	Subscribe
Omnispace	Agora Project	0 ~ 26.10.0	-

II. Public POCs for CVE-2026-63158

#	POC Description	Source Link	Shenlong Link

AI-Generated POC Premium

No public POC found.

III. Intelligence Information for CVE-2026-63158

请登录查看更多情报信息。

Same Patch Batch · Omnispace · 2026-10-13 · 21 CVEs total

CVE-2026-63146	9.8 CRITICAL	Omnispace Agora Project < 26.10.0 PHP Code Injection via config.inc.php
CVE-2026-63162	8.8 HIGH	Omnispace Agora Project < 26.10.0 Path Traversal via tmpFolderName Parameter
CVE-2026-63154	8.8 HIGH	Omnispace Agora Project < 26.10.0 SQL Identifier Injection via agoraFields[]
CVE-2026-63161	8.8 HIGH	Omnispace Agora Project < 26.10.0 Session Fixation via Authentication
CVE-2026-63153	8.1 HIGH	Omnispace Agora Project < 26.10.0 Broken Access Control via setAffectations()
CVE-2026-63174	8.1 HIGH	Omnispace Agora Project < 26.10.0 Broken Access Control via spaceAffectList
CVE-2026-63165	8.1 HIGH	Omnispace Agora Project < 26.10.0 SQL Injection via sortEvents Parameter
CVE-2026-63152	8.1 HIGH	Omnispace Agora Project < 26.10.0 Second-Order SQL Injection via _idCategoryFilter
CVE-2026-63163	7.5 HIGH	Omnispace Agora Project < 26.10.0 Broken Access Control via MobileFileDownload
CVE-2026-63149	7.4 HIGH	Omnispace Agora Project < 26.10.0 Predictable Default Password via uniqid()
CVE-2026-63159	7.4 HIGH	Omnispace Agora Project < 26.10.0 Predictable Password-Reset Token Account Takeover
CVE-2026-63160	7.4 HIGH	Omnispace Agora Project < 26.10.0 Insecure Remember-Me Token Storage
CVE-2026-63172	7.1 HIGH	Omnispace Agora Project < 26.10.0 Broken Function-Level Authorization via User-Edit
CVE-2026-63169	6.4 MEDIUM	Omnispace Agora Project < 26.10.0 Stored XSS via Messenger Iframe
CVE-2026-63156	6.1 MEDIUM	Omnispace Agora Project < 26.10.0 Reflected XSS via visioUrl Parameter
CVE-2026-63147	5.4 MEDIUM	Omnispace Agora Project < 26.10.0 Stored XSS via Uploaded File Name
CVE-2026-63148	5.4 MEDIUM	Omnispace Agora Project < 26.10.0 Stored XSS via Poll-Response Attachment Filename
CVE-2026-63168	5.4 MEDIUM	Omnispace Agora Project < 26.10.0 Stored XSS via Nested POST Array Bypass
CVE-2026-63171	5.4 MEDIUM	Omnispace Agora Project < 26.10.0 Stored XSS via Category Description
CVE-2026-63157	5.4 MEDIUM	Omnispace Agora Project < 26.10.0 Stored XSS via Links Module

IV. Related Vulnerabilities

Same product: Agora Project

Same vendor: Omnispace

Same weakness: CWE-836

V. Comments for CVE-2026-63158

No comments yet

Goal Reached Thanks to every supporter — we hit 100%!

CVE-2026-63158— Omnispace Agora Project < 26.10.0 Pass-the-Hash Authentication Bypass via Cookies

Quick assessment

Possible ATT&CK Techniques 2 AI

Affected Version Matrix 1

I. Basic Information for CVE-2026-63158

Vulnerability Information

Vulnerability Title

Vulnerability Description

CVSS Information

Vulnerability Type

Affected Products

II. Public POCs for CVE-2026-63158

III. Intelligence Information for CVE-2026-63158

Patches & Fixes for CVE-2026-63158 (1)

Vendor Advisories for CVE-2026-63158 (1)

Vendor Pages for CVE-2026-63158 (1)

Same Patch Batch · Omnispace · 2026-10-13 · 21 CVEs total

IV. Related Vulnerabilities

V. Comments for CVE-2026-63158

Leave a comment