CVE-2026-63158 in Agora Project
Summary
by MITRE • 10/13/2026
Omnispace Agora Project before 26.10.0 contains an authentication bypass vulnerability that allows attackers possessing a user's stored bcrypt password hash to authenticate as that user without knowing the actual password, caused by the legacy AGORAP_LOG/AGORAP_PASS cookie mechanism treating the stored hash as a directly replayable bearer credential. Attackers can set the AGORAP_LOG/AGORAP_PASS cookies with a stolen password hash to impersonate any user, including administrators, and gain unauthorized access to the application.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 10/13/2026
The Omnispace Agora Project prior to version 26.10.0 suffers from a critical authentication bypass vulnerability rooted in its legacy session management mechanism. This flaw specifically affects the AGORAP_LOG and AGORAP_PASS cookie implementation, which was designed for backward compatibility but fails to enforce proper cryptographic security principles. The core technical deficiency lies in the system's treatment of stored password hashes as direct bearer credentials rather than secret values that require proof of possession or derivation through a secure challenge-response mechanism. By design, modern authentication systems should never expose raw hash outputs as session tokens because these hashes are static and can be captured from database dumps or memory leaks without requiring knowledge of the plaintext password.
Attackers who obtain a user's stored bcrypt hash, whether through SQL injection, server-side file inclusion, or other data exfiltration techniques, can exploit this vulnerability to impersonate that user completely. The application accepts the provided hash in the AGORAP_PASS cookie and validates it against the expected value without performing any additional verification steps such as salting checks with dynamic nonces or verifying the integrity of the session state beyond a simple string comparison. This allows an attacker to set these cookies manually using tools like browser developer consoles or automated scripts, effectively bypassing the login process entirely. The impact is severe because it grants unauthorized access not only to standard user accounts but also to administrative privileges if the administrator's hash is compromised.
From a classification perspective, this vulnerability aligns with CWE-287 Improper Authentication and CWE-521 Weak Password Requirements or Storage, specifically regarding the misuse of password hashes as session identifiers. It also maps directly to MITRE ATT&CK technique T1078 Valid Accounts, where adversaries use legitimate credentials obtained through various means to maintain persistent access. The operational impact includes full compromise of user data, potential escalation to administrative control over the Omnispace Agora infrastructure, and violation of confidentiality and integrity requirements for sensitive systems handling proprietary or regulated information.
To mitigate this vulnerability, organizations must upgrade immediately to version 26.10.0 or later where the legacy cookie mechanism has been removed or secured with proper cryptographic practices such as HMAC-signed tokens or secure session IDs that are not derived directly from password hashes. For environments unable to patch immediately, disabling the AGORAP_LOG and AGORAP_PASS cookies entirely is recommended if they are no longer required for specific legacy integrations. Additionally, implementing strict cookie attributes including HttpOnly, Secure, and SameSite flags can reduce the risk of client-side theft via cross-site scripting attacks that might expose these values. Regular rotation of password hashes through re-hashing with updated salt parameters upon login also helps ensure that even if a hash is compromised, its utility for impersonation diminishes over time as users update their credentials.