CVE-2026-63156: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in Omnispace Agora Project

Omnispace Agora Project prior to version 26.10.0 contains a reflected XSS vulnerability due to improper neutralization of input during web page generation. The visioUrl parameter was not processed through the URL-sanitizing branch of the parameter filter and was urldecoded after filtering, allowing attackers to craft URLs with attribute breakout payloads. This leads to arbitrary JavaScript execution in the victim's browser pre-authentication. The vulnerability was addressed in version 26.10.0 by changes to app/Common/Req.php.

An unauthenticated attacker can exploit this vulnerability to execute arbitrary JavaScript in the context of the victim's browser session before authentication. This can lead to theft of sensitive information, session hijacking, or other client-side attacks. The CVSS 4.0 base score is 5.1 (medium severity), reflecting network attack vector, low attack complexity, no privileges required, and user interaction required.

Upgrade Omnispace Agora Project to version 26.10.0 or later, where the vulnerability has been fixed by proper input sanitization and filtering of the visioUrl parameter. No other mitigation is indicated by the vendor advisory.