Agora Project CVE-2026-63156

Exploitation requires the attacker to get a victim with access to a vulnerable Agora Project instance (any version before 26.10.0) to open a crafted URL whose visioUrl parameter carries an HTML attribute-breakout payload; the flaw triggers specifically because visioUrl bypasses the URL-sanitizing branch of the parameter filter and is urldecoded after filtering. No authentication is required (pre-authentication, PR:N), and no special server-side configuration is needed since the vulnerable parameter handling is in default request processing. The principal limiting factor is mandatory user interaction (UI:A) - the victim must click the malicious link - and the reflected (non-persistent) nature means there is no stored/self-propagating component.

This is a reflected cross-site scripting flaw (CWE-79) with a provided CVSS 4.0 base score of 5.1 (Medium). The vector CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A indicates network-reachable, low-complexity, pre-authentication exploitation (PR:N confirms unauthenticated) but requires active user interaction (UI:A) - the victim must click an attacker-crafted link. Impact is confined to the subsequent system (the victim's browser) with SC:L/SI:L and no direct confidentiality/integrity/availability impact to the Agora Project server itself (VC:N/VI:N/VA:N), which is consistent with reflected XSS. No EPSS score, no CISA KEV listing, and no public POC were provided in the input, so there is no public exploit identified at time of analysis and no evidence of active exploitation. The combination of mandatory user interaction, reflected (non-persistent) delivery, and a niche product footprint means this is a genuine but modest-priority issue rather than a mass-exploitation threat - prioritize patching for internet-facing deployments but it does not demand emergency response. No key signals are directly conflicting; the main gap is the absence of EPSS/KEV/POC data, which limits confidence in real-world exploitation likelihood.

An attacker crafts a malicious URL for a target Agora Project instance containing a visioUrl parameter with an HTML attribute-breakout payload, then delivers it to a victim via phishing email or a malicious link. Because the parameter was not routed through the URL-sanitizing filter branch and was urldecoded after filtering, the payload reflects into the page and executes arbitrary JavaScript in the victim's browser before authentication. No public POC was provided in the input.