CVE-2026-63159 Omnispace Agora Project < 26.10.0 Predictable Password-Reset Token Account Takeover

Omnispace Agora Project before 26.10.0 contains a predictable password-reset token vulnerability that allows unauthenticated attackers to take over user accounts by computing the reset token as sha1login.password, a deterministic and reusable value. Attackers can derive or brute-force the reset...

CVE-2026-63159 Omnispace Agora Project < 26.10.0 Predictable Password-Reset Token Account Takeover

Omnispace Agora Project before 26.10.0 contains a predictable password-reset token vulnerability that allows unauthenticated attackers to take over user accounts by computing the reset token as sha1login.password, a deterministic and reusable value. Attackers can derive or brute-force the reset...

CVE-2026-63159

The Omnispace Agora Project prior to version 26.10.0 is vulnerable to an account takeover due to a predictable password-reset token mechanism. The root cause is the use of a deterministic and reusable value, specifically sha1(login.password) , to generate reset tokens. This allows unauthenticated...