CVE-2026-63160 is a high severity (CVSS 7.4) credential storage flaw in Omnispace Agora Project before 26.10.0. The persistent remember-me token is stored on the server exactly as held in the user's cookie, so anyone who obtains the stored value can replay it. Upgrade to 26.10.
What's affected
The record says Omnispace Agora Project before 26.10.0. The weakness is CWE-522 (insufficiently protected credentials). Agora Project is the open source software behind the Omnispace collaboration service.
The remember-me token works like a password: whoever holds it is treated as the user. The server stores the same value it hands to the browser, so a copy of the database or a backup reveals working tokens. An attacker with that copy can sign in as the victim without the password.
The vector is network based with high complexity, no privileges and no user interaction, with high confidentiality and integrity impact. The high complexity reflects the need to first obtain the stored token.
Source note. The release page for 26.10 (the latest listed is 26.10.2) describes feature changes and does not mention security fixes, so the fixed version comes from the record, which says before 26.10.0. Upgrade to the current 26.10 release and confirm the change log for your build.
How to check if you're exposed
Check which release you run and whether the remember-me option is enabled.
grep -ri "version" /path/to/agora/app/ 2>/dev/null | head
The version is also shown in the application's administration area. Then ask who can read your database and backups. This flaw matters most if a database dump, backup or snapshot has ever been copied somewhere less protected than the live server.
Whatever the product, a current inventory of what you run is what turns a CVE notice into a quick answer. The Gold page for this CVE tracks how its record changes over time, and the free in-browser dependency scan at gold.safeguard.sh/scan covers the application libraries you ship.
What to do now
- Upgrade to the current 26.10 release of Agora Project.
- After the upgrade, expire existing remember-me sessions so tokens stored under the old scheme stop working. The record does not describe how; check the project documentation or clear the stored tokens in the database as a precaution.
- Review who has access to database backups and snapshots, and where copies are kept.
- Encrypt backups and restrict access to them.
- Turn on the new two-factor option mentioned in the 26.10 release page for accounts that matter.
Why it matters
Persistent login tokens are passwords in another form. The usual defence is to store only a hash of the token, so a leaked database does not give an attacker anything they can present. Storing the value as is turns every database leak into a set of live logins.
The weakness class is CWE-522. This flaw does not give an attacker a way in on its own; it raises the cost of any other leak. The record does not mark it as exploited in the wild.
Quick check
Does this let an attacker guess tokens?
No. The record describes replay of a stored token that has already been obtained, for example from a database or backup disclosure.
Sources
Last reviewed: 18 October 2026.
