CVE-2026-63156

Name of the Vulnerable Software and Affected Versions Omnispace Agora Project versions prior to 26.10.0

Description A reflected cross-site scripting issue allows unauthenticated attackers to inject malicious HTML attributes. This occurs because the visioUrl parameter is not routed through the URL-sanitizing branch of the parameter filter and is urldecoded after filtering. An attacker can craft a malicious URL containing the visioUrl parameter with an attribute breakout payload to execute arbitrary JavaScript in the victim's browser before authentication.

Recommendations Update to version 26.10.0.