PT-2026-113335

CVE-2026-63159

Published

2026-10-13

Updated

2026-10-13

Description by

CVSS 4.0

9.1

Critical

MetricsAV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions Omnispace Agora Project versions prior to 26.10.0

Description An issue exists where password-reset tokens are generated using a predictable method, specifically as sha1(login.password). Because this value is deterministic and reusable, unauthenticated attackers can compute or brute-force the token using known or guessed login and password combinations. This allows the creation of forged password-reset requests to hijack arbitrary user accounts.

Recommendations Update to version 26.10.0 or later.

Exploitability

Exploit

Fix

Researchers

Geoffrey Robert

Valentin Holubec

Vendors

Affected products

Weakness enumeration

CWE-640: Weak Password Recovery Mechanism for Forgotten Password

Related identifiers