{"id":"CVE-2026-63161","published":"2026-10-13T20:17:31.550","lastModified":"2026-10-15T14:47:05.720","description":"Omnispace Agora Project before 26.10.0 contains a session fixation vulnerability that allows remote attackers to hijack authenticated sessions by planting a known session identifier in a victim's browser prior to login. Attackers can exploit the application's failure to regenerate the session id upon successful authentication to gain unauthorized access to the victim's authenticated session after they log in.","cvssScore":8.8,"cvssSeverity":"HIGH","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","cwes":["CWE-384"],"vendors":[],"products":[],"references":[{"url":"https://github.com/xech/agora-project/releases/tag/26.10","tags":[]},{"url":"https://www.agora-project.net/","tags":[]},{"url":"https://www.vulncheck.com/advisories/omnispace-agora-project-session-fixation-via-authentication","tags":[]}],"exploitRefs":[{"url":"https://github.com/xech/agora-project/releases/tag/26.10","tags":[]}],"hasPoc":true,"ai":{"summary":"This vulnerability allows attackers to hijack user sessions by forcing the use of a known session ID, enabling them to gain unauthorized access to authenticated user accounts after login. This is particularly dangerous because it bypasses normal authentication mechanisms.","exploitability":"The exploit is relatively straightforward requiring only that an attacker can get a victim to visit a malicious link containing a predetermined session ID, with no additional preconditions needed for the attack to succeed.","blast_radius":"If exploited, this vulnerability could allow attackers to access any user's authenticated session data, potentially leading to full account compromise and unauthorized access to sensitive information or system functionality.","remediation":"Upgrade to Omnispace Agora Project version 26.10.0 or later to address the session fixation vulnerability.","detection":"No reliable host or network indicator is derivable from the published description.","tags":["session-fixation","authentication","web"],"model":"garnet-coder","analyzedAt":"2026-10-18T10:23:19.661Z"}}