EUVD-2026-100565
GHSA-2r64-8hvp-8498
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessIdentify target login on Agora instance
-
ExploitCompute or brute-force sha1(login.password) token
-
ExecutionSubmit forged password-reset request
-
ImpactSet new password and hijack account
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A07:2025 - Authentication Failures
ASVS 5.0
V6 - Authentication Password recovery security
|
| Exploitation Conditions | Exploitation requires the attacker to derive the password-reset token, which is the deterministic value sha1(login.password); the attacker must therefore know or successfully brute-force the target account's login and password combination to forge a valid reset request. This holds against default configurations of Agora Project before 26.10.0 using the standard password-recovery feature (no special setting needed), and requires no authentication and no user interaction. The principal LIMITING factor is the need to know/guess credentials to compute the token - reflected in CVSS AC:H - which makes opportunistic mass exploitation harder than a true no-knowledge bypass; exposure is further bounded to instances running versions prior to 26.10.0. |
| Impact | This is a CWE-640 weak password-recovery flaw in Agora Project rated CVSS 9.1 (CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N) - network-reachable, unauthenticated (PR:N), no user interaction, with high confidentiality and integrity impact from full account takeover. The elevated AC:H is the key tempering signal: the token is sha1(login.password), so an attacker must know or brute-force the victim's login AND password to compute the deterministic token, which is somewhat circular (knowing the password already implies compromise) and adds real exploitation friction, correctly reflected in the high attack complexity. No EPSS score was provided, the CVE is NOT in CISA KEV, and no public POC is indicated - so there is no evidence of active or widespread exploitation despite the high base score. A vendor patch is confirmed available (26.10.0). Net: a genuinely serious design flaw, but the combination of AC:H, absence of KEV/POC/EPSS signals, and the niche deployment footprint of this product argues for prompt patching rather than emergency drop-everything prioritization. CONFLICT TO VERIFY: the input Tags label this 'Information Disclosure,' but the description and CWE-640 describe account takeover/authentication compromise, not data disclosure. |
| Exploit ScenarioDerived | An attacker targeting a known Agora Project user computes or brute-forces the deterministic reset token sha1(login.password) and submits a forged password-reset request, resetting the victim's credentials and seizing the account. Because the token is reusable and predictable, no email interception or session is needed, though deriving it still requires knowledge or guessing of the login/password pair. No public exploit identified at time of analysis. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 13, 2026
Account takeover in Omnispace Agora Project before 26.10.0 is possible because the password-recovery feature mints reset tokens as the deterministic value sha1(login.password) instead of a random secret, so any party who knows or can guess a target's login and password pair can recompute a valid token and forge a reset request. The flaw is network-reachable and unauthenticated (CVSS 9.1, CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N, CWE-640) with high confidentiality and integrity impact, though the practical severity is tempered by the requirement to derive the credentials needed to compute the token, which is why the assessed AC is High. No public exploit code and no confirmed active exploitation were identified at time of analysis; the vendor has released 26.10.0 as the fixed version.
RemediationAI
Vendor-released patch: Agora Project 26.10.0, available from https://github.com/xech/agora-project/releases/tag/26.10, is the fixed version referenced by the vendor advisory (https://www.vulncheck.com/advisories/omnispace-agora-project-predictable-password-reset-token-account-takeover) and by the EUVD affected-version range; upgrade all instances running any release below 26.10.0 as the primary action. Because the token is derived from credentials, treat every account on a pre-26.10.0 instance as potentially compromised: after upgrading, force credential rotation for all users and invalidate any outstanding reset links, since a token remains valid until the underlying password changes. Compensating controls if immediate upgrade is not possible: disable or block the password-recovery endpoint entirely (for example by rejecting requests to the reset/reset-password route at the reverse proxy or web server), accepting that legitimate users can no longer self-service password resets and must be handled by an administrator; where the deployment offers no such toggle, restrict the application to trusted networks or place it behind an authenticating proxy so unauthenticated token submission is not reachable. Enforcing long, high-entropy, unique passwords reduces - but does not eliminate - an attacker's ability to guess the login.name/password input, so it should be treated as risk reduction only and not as a substitute for patching. The 2FA option introduced in the 26.10.0 release adds a second factor on top of the takeover path, but it ships with the fixed version and therefore is not a mitigation for unpatched hosts. Monitor authentication logs for password-reset requests originating from IPs that never received the corresponding reset email, which is the observable signature of token forgery.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The root cause is CWE-640 (Weak Password Recovery Mechanism for Forgotten Password). Rather than generating a cryptographically random, single-use, expiring token for the 'forgot password' flow, Agora Project builds the token as a deterministic hash of the account's own credentials - sha1(login.password). This design fails every core property a reset token needs: it has no entropy an attacker cannot obtain, it is stable across invocations (so a token observed, logged, or computed once remains valid indefinitely until the password changes), and it is not invalidated after use, which enables repeated abuse. Because the input to the digest is known to the user and, for weak or reused passwords, guessable to an attacker, the token can be computed offline rather than stolen from the victim's mailbox - eliminating the usual requirement to compromise the email account that receives the reset link. SHA-1 adds no protection here: its collision/preimage weaknesses are largely irrelevant because the attack is a direct recomputation, not a break of the hash. The CVSS 4.0 vector AV:N/AC:H/PR:N/UI:N with VC:H/VI:H reflects that the attack is remote and needs no prior session or victim interaction, but is gated by the credential-knowledge prerequisite; there is no impact on availability (VA:N), consistent with an account-takeover rather than a denial-of-service flaw. The affected population is bounded to Agora Project instances running versions prior to 26.10.0 that expose the standard password-recovery feature; no special configuration is required to reach the vulnerable code path.
Know when the next one hits your stack
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N
Network-reachable and unauthenticated (AV:N/PR:N), but token derivation needs known/guessed credentials so AC:H; account takeover yields C:H/I:H, no availability impact.
Primary rating from Vendor (vulncheck).
CVSS VectorVendor: vulncheck
Lifecycle Timeline
2DescriptionCVE.org
Omnispace Agora Project before 26.10.0 contains a predictable password-reset token vulnerability that allows unauthenticated attackers to take over user accounts by computing the reset token as sha1(login.password), a deterministic and reusable value. Attackers can derive or brute-force the reset token from known or guessed login and password combinations to forge valid password-reset requests and hijack arbitrary accounts.
Executive ViewAI
The Omnispace Agora Project contains a critical account-takeover flaw in its password-recovery function that lets an attacker forge valid password-reset tokens for any account whose login and password they already know or can guess, granting full control of that user's account. Because the service is network-reachable and the attack requires no prior authentication to the application, every organization running a version before 26.10.0 is exposed until it upgrades. Leadership should treat this as a high-priority patching event: successful exploitation yields direct access to business data and the ability to act under a legitimate user's identity, with potential downstream fraud, data loss, and regulatory exposure.
Apply vendor patch.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.
Exploit-DB