Omnispace Agora Critical Flaw: SHA-1 Hash Enables Account Hijack in Versions Before 26.10.0

Omnispace Agora Project contains a critical vulnerability involving predictable password-reset tokens. This flaw allows unauthenticated attackers to take over user accounts by deriving valid reset credentials. The issue affects all releases before version 26.10.0, exposing environments running these older versions.

Root cause

The vulnerability stems from how the application generates password-reset tokens. According to the NVD record, the system computes the token as the SHA-1 hash of the combination of the user's login and password. This creates a deterministic and reusable value rather than a unique, random session identifier. Because the input values are often known or guessable, the resulting token is not secret.

Attack path

An attacker does not need prior authentication to exploit this weakness. By knowing or guessing a valid login and password combination, they can compute the SHA-1 hash locally. This derived value serves as a valid password-reset token. The attacker can then forge a reset request, effectively hijacking the arbitrary account.

Affected versions

• Omnispace Agora Project versions before 26.10.0 are vulnerable.
• The source material specifies that versions before 26.10.0 contain the vulnerability.

Mitigation

• Upgrade Omnispace Agora Project to version 26.10.0 or newer immediately.
• Audit logs for successful password resets using tokens that match known hashes.
• Enforce complex password policies to increase the difficulty of guessing inputs.
• Monitor for unauthenticated access attempts to the password-reset endpoint.

Signals worth monitoring

Security teams should monitor for unusual password-reset activity, particularly from unauthenticated sources. Look for requests that bypass standard rate-limiting or come from unfamiliar IP addresses. Check whether reset tokens correlate with known user credentials in your logs. Analyse traffic patterns for repetitive attempts that suggest offline computation rather than interactive login failures. Review account change logs for sudden credential updates following reset requests. Implement alerts for any reset activity that occurs outside normal business hours or from new geographic locations.

What to do and how to stay safe: Omnispace

• Verify your Omnispace Agora Project version and upgrade if it is below 26.10.0.
• Review authentication logs for unauthenticated requests to password-reset endpoints.
• Enforce strong password complexity to reduce the feasibility of input guessing.
• Monitor for anomalous account takeover indicators such as rapid password changes.

Step-by-step guide: Out-of-band patches: what small businesses need to know

General security guidance from the Firewall Pulse newsroom. It is not confirmed advice from the organisations named in this story.

Frequently asked questions

What is the CVSS score for CVE-2026-63159?

The Common Vulnerability Scoring System rate is 9.1, which is classified as critical.

How does the attacker generate the reset token?

The attacker computes the SHA-1 hash of the user's login and password combination.

Which versions of Omnispace Agora are affected?

All versions of Omnispace Agora Project before 26.10.0 are affected by this flaw.