CVE-2026-63155

CVSS 6.1 (medium) · published 2026-11-13

Omnispace Agora Project through 26.10.0 contains an open redirect vulnerability that allows remote attackers to redirect users to arbitrary external URLs by manipulating the objUrl parameter in Ctrl.php's redir() function. Attackers can craft login links with objUrl set to a malicious site, causing the application to issue an HTTP 302 redirect to that external URL, which can be abused for phishing and credential theft.

Weakness: CWE-601

Source: NVD CVE-2026-63155

References

• https://www.agora-project.net/
• https://www.akailabs.fr/blog/multiple-vulnerabilities-in-agora-project-26-5-2#cve-2026-63155-open-redirect-and-reflected-xss-via-objurl
• https://www.vulncheck.com/advisories/omnispace-agora-project-open-redirect-via-objurl-parameter

Check your software

Connect an AI agent to the FixLane MCP server or ask the Telegram bot to check what you have installed against incidents with a verified fixed version.