Agora Project EUVD-2026-100581

Exploitation requires the application's failure to regenerate the session identifier upon successful authentication (the core defect in Agora Project before 26.10.0). The attacker must be able to fix/plant a known session identifier in the victim's browser before login (e.g., via a crafted link or a pre-set cookie), and the victim must then actively authenticate to that same session - this victim login is the required user interaction reflected by CVSS UI:A, and it is the primary factor limiting exploitation. The flaw applies to Agora Project versions prior to 26.10.0; upgrading to 26.10.0 (which also adds optional 2FA) remediates it. No attacker authentication or elevated privileges are required (PR:N).

This is a genuine but conditionally-exploitable risk rather than a drop-everything emergency. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:A) confirms a network-reachable flaw requiring no attacker privileges, with high impact to confidentiality, integrity and availability of the vulnerable system (VC:H/VI:H/VA:H) and no scope change to subsequent systems (SC:N/SI:N/SA:N), yielding a HIGH 8.6 score. The decisive limiting signal is UI:A: successful exploitation depends on the victim subsequently authenticating in a browser the attacker has already seeded with a known session identifier, so this is not a purely attacker-driven remote takeover. No EPSS score, SSVC decision, KEV listing, or POC was provided in the input, so exploitation probability and automatability cannot be quantified here; absence of these is not evidence of safety but does lower immediate urgency. Net: prioritize patching for any internet-exposed Agora Project instance, but treat it as a session-fixation account-takeover requiring victim interaction, not as mass-automatable unauthenticated RCE. Confidentiality/integrity/availability impact (VC/VI/VA:H) is as rated by the source and should be verified against the privilege level of the hijacked account.

An attacker seeds a victim's browser with a session identifier the attacker already knows (e.g., via a crafted link or injected cookie before the victim logs in). Because Agora Project before 26.10.0 fails to regenerate the session id on successful authentication, once the victim logs in the attacker reuses that fixed identifier to ride the now-authenticated session and act as the victim. No public exploit code was identified at time of analysis, and the attack requires the victim to complete a login (CVSS UI:A).