CVE-2026-63160

Name of the Vulnerable Software and Affected Versions Omnispace Agora Project versions prior to 26.10.0

Description The software stores the persistent remember-me token verbatim on the server side, which makes the stored value identical to the bearer credential held in the user's cookie. An attacker who obtains the stored token, for example through database or backup disclosure, can replay the plaintext value to authenticate as the victim user without requiring a password.

Recommendations Update to version 26.10.0 or later.