CVE-2026-63158: Use of Password Hash Instead of Password for Authentication in Omnispace Agora Project
Description
Omnispace Agora Project versions before 26.10.0 have an authentication bypass vulnerability where attackers can use a stored bcrypt password hash as a bearer token to authenticate without the actual password. This is due to the legacy AGORAP_LOG/AGORAP_PASS cookie mechanism treating the password hash as a directly replayable credential. Exploitation allows impersonation of any user, including administrators, leading to unauthorized access.
CVSS v4.0
Score 9.1critical
Affected software
Omnispace
Agora Project
Run on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
CVE-2026-63158 describes an authentication bypass in Omnispace Agora Project prior to version 26.10.0. The vulnerability arises because the legacy AGORAP_LOG/AGORAP_PASS cookies accept a user's stored bcrypt password hash as a valid authentication token. An attacker who obtains a user's password hash can set these cookies and gain access as that user without knowing the actual password. This flaw enables impersonation of any user, including privileged accounts, compromising application security.
Potential Impact
Attackers possessing a user's bcrypt password hash can bypass authentication controls and impersonate that user, including administrators. This leads to unauthorized access to the application and potentially full control over user accounts and administrative functions.
Mitigation Recommendations
Patch status is not yet confirmed — check the vendor advisory for current remediation guidance.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- VulnCheck
- Date Reserved
- 2026-07-15T21:18:20.186Z
- Cvss Version
- 4.0
- State
- PUBLISHED
Threat ID: 6ace8ef62cdf04f656a6859c
Added to database: 10/13/2026, 20:05:10 UTC
Last enriched: 10/13/2026, 20:18:22 UTC
Last updated: 10/13/2026, 20:18:22 UTC
Views: 4
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.