Skip to content
Heist/ feed
Critical

Omnispace Agora Project < 26.10.0 Predictable Default Password via uniqid()

Type: advisorySource: Official CVE List1 source record

Omnispace Agora Project before 26.10.0 contains an insecure randomness vulnerability that allows attackers to predict temporary or default account passwords generated by Txt::defaultPassword() using PHP's uniqid() function based on server time in microseconds. Attackers who observe or approximate the account creation time can compute the predictable password and take over the account before the legitimate user logs in.

Announced Source revision 1
Original source ↗

CVE-2026-63149

Primary source · Revision 1

Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.

Security context

Source reference: cve:CVE-2026-63149

Agora Project

Source reference: /containers/cna/affected/0/product

Affected versions
Not stated in this record
Fixed versions
Not stated in this record
Prerequisites
Not stated in this record

Structured affected-version data

Original package identities and version rules from this source.

[
  {
    "repo": "https://github.com/xech/agora-project",
    "vendor": "Omnispace",
    "product": "Agora Project",
    "versions": [
      {
        "status": "affected",
        "version": "0",
        "lessThan": "26.10.0",
        "versionType": "semver"
      }
    ],
    "packageURL": "pkg:github/xech/agora-project",
    "defaultStatus": "unaffected"
  }
]
Related CVEs
CVE-2026-63149

Source reference: /cveMetadata/cveId

Publisher severity

critical

Source reference: /containers/cna/metrics

Event
#22781 · Revision 1
Added to Heist Feed
Publisher date
Read the original announcement