CVE-2026-63155

Omnispace Agora Project through 26.10.0 contains an open redirect vulnerability that allows remote attackers to redirect users to arbitrary external URLs by manipulating the objUrl parameter in Ctrl.php's redir function. Attackers can craft login links with objUrl set to a malicious site, causing...