What’s Vulnerable › Vulnerabilities

CVE-2026-63161: Omnispace Agora Project < 26.10.0 Session Fixation via Authentication

• Severity: high (CVSS 8.8 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.4% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2026-10-13 · updated 2026-10-27
• Weakness: CWE-384

Description

Omnispace Agora Project before 26.10.0 contains a session fixation vulnerability that allows remote attackers to hijack authenticated sessions by planting a known session identifier in a victim's browser prior to login. Attackers can exploit the application's failure to regenerate the session id upon successful authentication to gain unauthorized access to the victim's authenticated session after they log in.

Affected products

• Omnispace Agora Project: before 26.10.0 — fixed in 26.10.0

How to fix

Upgrade to a fixed version: Omnispace Agora Project 26.10.0. Check the vendor advisory for mitigations.

References

• https://github.com/xech/agora-project/releases/tag/26.10
• https://www.agora-project.net/
• https://www.vulncheck.com/advisories/omnispace-agora-project-session-fixation-via-authentication

Get alerted when CVE-2026-63161 or the next vulnerability affects your stack