CVE-2026-63170 Omnispace Agora Project 26.10.0 Predictable Share Token via md5Id

Omnispace Agora Project through 26.10.0 contains a predictable token generation vulnerability that allows unauthenticated attackers to forge the shared-calendar iCal share token by deriving md5Id from predictable fields such as object creation time, which is self-disclosed through autorDate and t...

CVE-2026-63170

Omnispace Agora Project through 26.10.0 contains a predictable token generation vulnerability that allows unauthenticated attackers to forge the shared-calendar iCal share token by deriving md5Id from predictable fields such as object creation time, which is self-disclosed through autorDate and t...

CVE-2026-63151

Omnispace Agora Project through 26.10.0 contains a predictable token generation vulnerability that allows unauthenticated attackers to access private calendar data by exploiting a missing dateCrea value that causes the md5Id token to collapse to md5calendarId.userId, both small enumerable integer...

CVE-2026-63151 Omnispace Agora Project 26.10.0 Predictable Token Information Disclosure via DisplayIcal

Omnispace Agora Project through 26.10.0 contains a predictable token generation vulnerability that allows unauthenticated attackers to access private calendar data by exploiting a missing dateCrea value that causes the md5Id token to collapse to md5calendarId.userId, both small enumerable integer...