Agora Project EUVD-2026-100563

Exploitation requires that the target account's password was generated by Txt::defaultPassword() using PHP uniqid() seeded on microsecond server time - i.e., default/temporary password flows such as new-account creation or administrative password resets in Agora Project before 26.10.0. The attacker must observe or approximate the account creation timestamp closely enough to narrow the uniqid() search space, and must authenticate before the legitimate user first logs in and changes the password. Limiting factors per the CVSS vector (PR:N/UI:N but AC:H): no authentication or victim interaction is needed, but the timing-reconstruction and login race materially raise attack complexity; accounts created with user-chosen passwords rather than the generated default are not affected.

The input provides a CVSS 4.0 base score of 9.1 (AV:N/AC:H/PR:N/UI:N/VC:H/VI:H/VA:N), indicating a network-reachable, unauthenticated flaw with high confidentiality and integrity impact but HIGH attack complexity. The AC:H rating is the key moderating signal: successful exploitation depends on the attacker observing or approximating the microsecond-resolution server time at account creation to reconstruct the uniqid()-derived password, and winning a race against the legitimate user's first login. No EPSS score was provided, and the CVE is NOT listed in CISA KEV; no POC/exploit-code flag was supplied, so exploitation is not confirmed. The SSVC framework data (exploitation status, automatable, technical impact) is not present in the input. Net assessment: this is a genuine account-takeover primitive worth patching, but the combination of HIGH attack complexity, the timing/race prerequisite, and the product's narrow deployment footprint makes it a targeted-exploitation risk rather than a mass-exploited emergency. The 9.1 headline score overstates practical urgency relative to the AC:H and real-world prevalence signals.

An attacker triggers or observes creation of a new account (or a default/temporary password reset) in Agora Project and records the approximate account-creation time. Because Txt::defaultPassword() derives the password from PHP's uniqid() seeded by server time in microseconds, the attacker computes the likely password within the narrow time window and authenticates as the victim before the legitimate user ever logs in. No public exploit identified at time of analysis, but the predictable-randomness logic is straightforward to reproduce.