CVE-2026-63149: Use of Insufficiently Random Values in Omnispace Agora Project
Description
CVE-2026-63149 is a critical vulnerability in Omnispace Agora Project versions before 26.10.0. It involves the use of insufficiently random values for generating temporary or default account passwords via PHP's uniqid() function, which relies on server time in microseconds. This predictability allows attackers who can observe or approximate account creation times to compute these passwords and potentially take over accounts before legitimate users log in.
CVSS v4.0
Score 9.1critical
Affected software
Omnispace
Agora Project
Run on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
Omnispace Agora Project prior to version 26.10.0 uses PHP's uniqid() function to generate temporary or default passwords in the Txt::defaultPassword() method. Since uniqid() is based on the server's microsecond timestamp, the generated passwords are predictable if an attacker can estimate the account creation time. This insecure randomness vulnerability enables attackers to guess these passwords and gain unauthorized access to accounts before the legitimate user logs in.
Potential Impact
Attackers can predict temporary or default passwords generated during account creation, allowing them to take over user accounts before the legitimate user logs in. This compromises account confidentiality and integrity, potentially leading to unauthorized access and control over affected accounts.
Mitigation Recommendations
A fix is available in Omnispace Agora Project version 26.10.0 and later. Users should upgrade to version 26.10.0 or newer to remediate this vulnerability. No additional mitigation steps are indicated by the vendor advisory.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- VulnCheck
- Date Reserved
- 2026-07-15T21:18:20.185Z
- Cvss Version
- 4.0
- State
- PUBLISHED
Threat ID: 6ace8bb12cdf04f656a47545
Added to database: 10/13/2026, 19:51:13 UTC
Last enriched: 10/13/2026, 20:03:38 UTC
Last updated: 10/13/2026, 20:05:06 UTC
Views: 5
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.