Patch Agora Project to Stop Attackers Using Stolen Hashes for Admin Access
A critical flaw in Omnispace Agora allows attackers to bypass login checks by replaying stolen password hashes, granting full account control until version 26.10.0 is deployed.
Key points
- CVE-2026-63158 allows authentication bypass via cookie manipulation in Omnispace Agora.
- Attackers can impersonate any user, including administrators, using only a stored bcrypt hash.
- The vulnerability affects all versions of the Omnispace Agora Project before 26.10.0.
Attackers can gain full unauthorized access to Omnispace Agora Project accounts by exploiting a critical authentication bypass vulnerability. According to the National Vulnerability Database, this flaw allows threat actors to impersonate any user, including system administrators, without knowing the actual password. The attack requires possession of a user's stored bcrypt password hash.
The vulnerability, identified as CVE-2026-63158, carries a CVSS score of 9.1, classified as critical. It stems from how the application handles legacy authentication cookies. Specifically, the AGORAP_LOG and AGORAP_PASS cookies treat the stored hash as a directly replayable bearer credential. This design error allows an attacker to set these cookies with a stolen hash and successfully authenticate as that user.
Context of the vulnerability
The issue exists in the legacy cookie mechanism of the Omnispace Agora Project. The application incorrectly processes the AGORAP_LOG and AGORAP_PASS cookies by accepting the stored password hash as a valid bearer credential. This means the system allows authentication using the hash directly, bypassing the need for the actual password.
This weakness is categorized under CWE-836. The flaw allows for straightforward impersonation because the attacker does not need to crack the hash or guess the password. They simply need to inject the known hash into the specific cookie fields to assume the identity of the target account, including administrative roles.
Who is affected
All versions of the Omnispace Agora Project prior to 26.10.0 are affected by this vulnerability. The National Vulnerability Database record confirms that any deployment running software older than version 26.10.0 is susceptible to this authentication bypass. Organizations using the Agora Project for collaboration or project management must verify their current version immediately to determine exposure.
Small-business owners and IT administrators should audit their installations to ensure they are not running vulnerable versions. The risk is particularly high for administrative accounts, as gaining access to these roles provides broad control over the application and its data. Any environment where password hashes have been exposed is at immediate risk of compromise.
What to watch
Monitor for unusual login activity or session anomalies in the Agora Project interface. Watch for unauthorized changes to user permissions or project settings, which may indicate that an attacker has successfully impersonated an administrator. Keep an eye on vendor communications for patches and security advisories related to CVE-2026-63158.
Verify that your current version is 26.10.0 or later. If you are running an older version, prioritize updating your software as soon as possible. Ensure that your backup and recovery procedures are intact before applying updates, to mitigate any potential deployment risks.
What made it possible
Teams usually rely on password hashes to protect user credentials, assuming that storing the hash prevents direct access. This incident highlights a failure in session management where the hash itself became a valid login token. Check whether your applications treat cryptographic hashes as secrets rather than public identifiers. Ensure that authentication mechanisms require proof of the original password, not just possession of the stored hash, to prevent replay attacks.
Background: Security advisories
Security advisories provide the technical context needed to prioritize patches. They explain the severity, affected components, and mitigation steps. Without them, teams guess which fixes matter, leaving critical gaps open to exploitation while wasting time on low-risk updates.
Read the full guide: How Security Advisories Drive Patch Decisions and Reduce Risk
What to do and how to stay safe
- Severity scores alone ignore whether a vulnerability is reachable from the internet or protected by other controls.
- Contextual data like asset criticality and existing compensating controls changes the priority of a flaw.
- Automating the intake of data from scans reduces the manual effort required to triage findings.
Prioritize vulnerabilities by combining technical severity with business context and exploitability to focus your limited resources effectively. Start by mapping your critical assets and integrating threat intelligence into your scanning workflow.
Step-by-step guide: Risk-Based Vulnerability Management: How to Prioritize What to Fix First
General security guidance from the Shell Bulletin newsroom. It is not confirmed advice from the organisations named in this story.
