Threats tagged 'ghsa-92qx-w82f-vmrj'

Omnispace Agora Project versions before 26.10.0 have an authentication bypass vulnerability. This flaw allows attackers who have obtained a user's stored bcrypt password hash to authenticate as that user without knowing the actual password. The vulnerability arises from the legacy AGORAP_LOG/AGORAP_PASS cookie mechanism, which treats the stored hash as a bearer token that can be replayed directly. Attackers can set these cookies with a stolen hash to impersonate any user, including administrators, gaining unauthorized access.