CVE-2026-63160

CVSS 9.1 (critical) · published 2026-10-13

Omnispace Agora Project before 26.10.0 contains a vulnerability where the persistent remember-me token is stored verbatim server-side, making the stored value identical to the bearer credential held in the user's cookie. Attackers who gain access to the stored token, such as through database or backup disclosure, can replay the plaintext value to authenticate as the victim user without needing their password.

Weakness: CWE-522

Source: NVD CVE-2026-63160

References

• https://github.com/xech/agora-project/releases/tag/26.10
• https://www.agora-project.net/
• https://www.akailabs.fr/blog/multiple-vulnerabilities-in-agora-project-26-5-2#cve-2026-63160-insecure-remember-me-token-storage
• https://www.vulncheck.com/advisories/omnispace-agora-project-insecure-remember-me-token-storage

Check your software

Connect an AI agent to the FixLane MCP server or ask the Telegram bot to check what you have installed against incidents with a verified fixed version.