---
id: CVE-2026-63160
title: >-
  Omnispace Agora Project before 26.10.0 contains a vulnerability where the
  persistent remember-me token is stored verbatim server-side, making the stored
  value identical to the bearer credential held in the user's cookie
summary: >-
  Omnispace Agora Project before 26.10.0 contains a vulnerability where the
  persistent remember-me token is stored verbatim server-side, making the stored
  value identical to the bearer credential held in the user's cookie. Attackers
  who ga…
severity: high
cvss: 7.4
cvssVector: 'CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N'
cwe:
  - CWE-522
published: '2026-10-13'
updated: '2026-10-13'
sourceUpdated: '2026-10-13T20:17:31.420'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-63160'
references:
  - url: 'https://github.com/xech/agora-project/releases/tag/26.10'
    label: disclosure@vulncheck.com
  - url: 'https://www.agora-project.net/'
    label: disclosure@vulncheck.com
  - url: >-
      https://www.vulncheck.com/advisories/omnispace-agora-project-insecure-remember-me-token-storage
    label: disclosure@vulncheck.com
tags:
  - nvd
ingestedAt: '2026-10-13T20:53:44.643Z'
---

## Overview

Omnispace Agora Project before 26.10.0 contains a vulnerability where the persistent remember-me token is stored verbatim server-side, making the stored value identical to the bearer credential held in the user's cookie. Attackers who gain access to the stored token, such as through database or backup disclosure, can replay the plaintext value to authenticate as the victim user without needing their password.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.