Agora Project CVE-2026-63160

Exploitation requires the attacker to first obtain the stored remember-me token from the server side - concretely, read access to the Agora Project database table holding remember-me tokens or to an unencrypted backup containing it (the description names 'database or backup disclosure'). The limiting factor is that this is NOT self-contained: it presumes a separate disclosure foothold, which is why CVSS assigns AC:H. It also requires that the victim actually used the persistent 'remember me' feature so a token exists to steal. Once the plaintext token is held, no password, no further authentication, and no user interaction are needed to replay it. Affected: all Agora Project versions before 26.10.0; fixed in 26.10.0.

This is a credential-protection flaw (CWE-522) in Agora Project where the persistent remember-me token is stored server-side in plaintext, identical to the bearer value in the user's cookie - so any read of the stored token yields a directly replayable credential. The input CVSS 4.0 vector (AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:H) scores 9.1, but the AC:H and the description ('such as through database or backup disclosure') reveal the critical caveat: exploitation is contingent on the attacker FIRST obtaining the stored token through a separate compromise (SQL injection, backup leak, DB access, insider). This is therefore an impact-amplifier, not a standalone remotely-triggerable RCE. No EPSS score was supplied, the CVE is NOT in CISA KEV, and no public POC is indicated, so there is no public exploit identified at time of analysis - signals point to latent/targeted risk rather than active widespread exploitation. The high VC:H/VI:H is justified (full account takeover once the token is held), but the 9.1 headline overstates day-one internet-facing risk given the AC:H precondition. Treat as a meaningful hardening priority for exposed Agora instances, especially where DB/backup hygiene is weak, rather than an emergency internet-wide threat.

An attacker obtains a copy of the Agora Project database or an unencrypted backup (e.g., via a misconfigured backup share or a separate injection flaw) and reads the stored remember-me tokens. Because each stored token is byte-identical to the live cookie credential, the attacker sets it as their own cookie and is authenticated as the victim without a password. No public exploit code is identified at time of analysis, and the attack chain depends on a prior data-disclosure foothold.