Description
Omnispace Agora Project through 26.10.0 contains a predictable token generation vulnerability that allows unauthenticated attackers to access private calendar data by exploiting a missing dateCrea value that causes the md5Id token to collapse to md5(calendarId.userId), both small enumerable integers. Attackers can compute valid tokens and request the misc&action=DisplayIcal endpoint with a forged md5Id to read any user's private calendar events without authentication.
Published: 2026-11-13
Score: 8.7 High
EPSS: n/a
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Analysis and contextual insights are available on OpenCVE Cloud.

Remediation

No vendor fix or workaround currently provided.

Additional remediation guidance may be available on OpenCVE Cloud.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Fri, 13 Nov 2026 17:30:00 +0000

Type Values Removed Values Added
References

Fri, 13 Nov 2026 17:15:00 +0000

Type Values Removed Values Added
Description Omnispace Agora Project through 26.10.0 contains a predictable token generation vulnerability that allows unauthenticated attackers to access private calendar data by exploiting a missing dateCrea value that causes the md5Id token to collapse to md5(calendarId.userId), both small enumerable integers. Attackers can compute valid tokens and request the misc&action=DisplayIcal endpoint with a forged md5Id to read any user's private calendar events without authentication.
Title Omnispace Agora Project 26.10.0 Predictable Token Information Disclosure via DisplayIcal
First Time appeared Agora-project
Agora-project agora-project
Weaknesses CWE-330
CPEs cpe:2.3:a:agora-project:agora-project:*:*:*:*:*:*:*:*
Vendors & Products Agora-project
Agora-project agora-project
References
Metrics cvssV3_1

{'score': 7.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N'}

cvssV4_0

{'score': 8.7, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N'}

Subscriptions

Agora-project Agora-project
cve-icon MITRE

Status: PUBLISHED

Assigner: VulnCheck

Published:

Updated: 2026-11-13T17:16:33.331Z

Reserved: 2026-07-15T21:18:20.185Z

Link: CVE-2026-63151

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Received

Published: 2026-11-13T17:17:33.570

Modified: 2026-11-13T17:17:33.570

Link: CVE-2026-63151

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

No data.

Weaknesses
  • CWE-330

    Use of Insufficiently Random Values