CVE-2026-63170

CVSS 6.3 (medium) · published 2026-11-13

Omnispace Agora Project through 26.10.0 contains a predictable token generation vulnerability that allows unauthenticated attackers to forge the shared-calendar iCal share token by deriving md5Id() from predictable fields such as object creation time, which is self-disclosed through autorDate and the iCal CREATED field. Attackers can compute the creation minute and forge the md5Id token to access and read a shared calendar's iCal feed without authorization.

Weakness: CWE-340

Source: NVD CVE-2026-63170

References

• https://www.agora-project.net/
• https://www.akailabs.fr/blog/multiple-vulnerabilities-in-agora-project-26-5-2#cve-2026-63170-shared-calendar-ical-share-token-forgeable-from-a-leaked-creation
• https://www.vulncheck.com/advisories/omnispace-agora-project-predictable-share-token-via-md5id

Check your software

Connect an AI agent to the FixLane MCP server or ask the Telegram bot to check what you have installed against incidents with a verified fixed version.