External risk intelligence

Agora Project Insecure Randomness Predictable Password Vulnerability.

CVE advisorySeverity: CRITICAL (CVSS 9.1)

CVE-2026-63149

Agora Project is a groupware and collaborative web application platform. By design, such platforms are typically deployed as internet-facing web applications to enable remote collaboration, making the user account creation and authentication interface a commonly exposed surface.

Halo Surface Signal: 4 out of 5 — likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

This vulnerability affects Omnispace Agora Project, a collaborative web application platform. It involves predictable temporary passwords that could allow unauthorized access to accounts before legitimate users can log in. The main concern is confirming the relevance and exposure of this technology within our environment.

Predictable temporary passwords enable account takeover.
Early access could disrupt operations or data integrity.
Assess usage and confirm relevance for this project.

Attack Path

How an attacker could exploit the issue

An attacker can predict temporary account passwords by observing or approximating the server's timestamp when an account is created. This is possible because the password generation function uses a predictable method based on time. If an attacker can guess this timestamp, they can compute the password and gain access to the account before the intended user.

Unauthenticated network access required.
Predictable password generation via time.
Account takeover before legitimate login.

Live Threat

Current exploitation, exposure, and threat context

An insecure randomness vulnerability in Omnispace Agora Project could allow attackers to predict temporary or default account passwords. When supported by the advisory, attackers who can approximate the account creation time may be able to compute the password and hijack accounts before legitimate users log in.

Temporary account passwords may be predictable.
Predictable passwords enable unauthorized account access.
Account takeover before legitimate user login.

Operational Fix

Recommended remediation, mitigation, and detection steps

Application owners and platform teams are likely responsible for addressing this vulnerability, as it affects a collaborative web application platform. The immediate priority is to identify all instances of the affected technology, determine their exposure and business criticality, and then assign an accountable owner for remediation.

Application or Platform team ownership.
Verify unpatched instances and exposure.
Plan remediation within maintenance windows.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is Omnispace Agora Project?

Omnispace Agora Project is a collaborative groupware platform designed to support team interaction and information sharing. Organizations typically deploy this software as a web-based application, allowing users to coordinate projects, manage calendars, and exchange documents remotely from various locations.

What does CWE-330 mean for CVE-2026-63149?

CWE-330 refers to the use of insufficient or insecure randomness. In this CVE, the software uses a predictable method—specifically the PHP uniqid function tied to server time—to generate temporary account passwords. Because these passwords rely on easily guessable microsecond timestamps rather than a cryptographically secure source, they lack the necessary entropy to remain private.

How can an attacker trigger this vulnerability?

An attacker can compute a valid temporary password if they can approximate the specific microsecond time when an account was created. This process does not require authenticated access. However, the vulnerability is not triggered if the system configuration does not use the default password generation method or if the account creation process is not exposed to an attacker capable of observing account activity.

Is my instance at risk according to Halo Surface Signal?

Halo Surface Signal indicates that Agora Project is often deployed as an internet-facing application to facilitate remote collaboration, which increases the likelihood of external exposure. Because the authentication interface is accessible to anyone on the network, any internet-facing deployment is a primary concern for potential unauthorized account access.

What should I do if I run Agora Project?

Begin by identifying all running instances of Agora Project and confirming their current version. Prioritize verifying if any instances are below version 26.10.0, as these are affected. Work with your platform team to review your exposure level, assess the business criticality of those instances, and schedule the necessary software updates during your next maintenance window.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.