High severity · published Oct 13, 2026
CVE-2026-63149
Omnispace Agora Project < 26.10.0 Predictable Default Password via uniqid()
7.4
CVSS
0.4%
EPSS
No
On KEV
Description
Omnispace Agora Project before 26.10.0 contains an insecure randomness vulnerability that allows attackers to predict temporary or default account passwords generated by Txt::defaultPassword() using PHP's uniqid() function based on server time in microseconds. Attackers who observe or approximate the account creation time can compute the predictable password and take over the account before the legitimate user logs in.
CVSS vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N
Attack vector
Network
Complexity
High
Privileges
None
User interaction
None
Confidentiality
High
Integrity
High
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.4% · higher than 30% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
AP
Agora Project · Omnispace
before 26.10.0 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-63149
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-63149
release-notes
https://github.com/xech/agora-project/releases/tag/26.10
product
https://www.agora-project.net/
third-party-advisory
https://www.vulncheck.com/advisories/omnispace-agora-project-predictable-default-password-via-uniqid
More from Agora Project
9.8
CVE-2026-63146
Omnispace Agora Project < 26.10.0 PHP Code Injection via config.inc.php
8.8
CVE-2026-63161
Omnispace Agora Project < 26.10.0 Session Fixation via Authentication
8.8
CVE-2026-63162
Omnispace Agora Project < 26.10.0 Path Traversal via tmpFolderName Parameter
8.8
CVE-2026-63154
Omnispace Agora Project < 26.10.0 SQL Identifier Injection via agoraFields[]
8.1
CVE-2026-63174
Omnispace Agora Project < 26.10.0 Broken Access Control via spaceAffectList