Threats tagged 'ghsa-w2w8-jwvc-3ghv'

Omnispace Agora Project versions before 26.10.0 have a vulnerability where the persistent remember-me token is stored in plaintext on the server side. This token is identical to the bearer credential in the user's cookie. If an attacker obtains this stored token, for example via database or backup disclosure, they can use it to authenticate as the victim without needing the user's password.