PT-2026-113337

CVE-2026-63161

Published

2026-10-13

Updated

2026-10-13

Description by

CVSS 3.1

8.8

High

MetricsAV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Omnispace Agora Project versions prior to 26.10.0

Description A session fixation issue exists where the application fails to regenerate the session identifier after a user successfully authenticates. This allows a remote attacker to hijack an authenticated session by planting a known session identifier in a victim's browser before they log in.

Recommendations Update to version 26.10.0 or later.

Exploitability

Exploit

Fix

Impacts

Researchers

Geoffrey Robert

Valentin Holubec

Vendors

Affected products

Weakness enumeration

CWE-384: Session Fixation