Key points
- The flaw allows prediction of temporary or default passwords generated by the Txt::defaultPassword() function.
- The vulnerability relies on PHP's uniqid() function, which bases output on server time in microseconds.
- It affects Omnispace Agora Project versions prior to 26.10.0 and is rated Critical with a CVSS score of 9.1.
Security researchers have identified a critical flaw in Omnispace Agora Project that allows attackers to predict default account passwords. The vulnerability, tracked as CVE-2026-63149, exists in all versions of the software before 26.10.0. It enables adversaries to compute credentials before legitimate users log in, granting them immediate control over new accounts.
The issue stems from how the application generates these temporary passwords. According to the NVD record, the Txt::defaultPassword() function uses PHP's uniqid() to create these strings. Because this function relies on server time in microseconds, the resulting output is not sufficiently random. Attackers who can approximate the time of account creation can reverse-engineer the password generation process.
Technical context of the flaw
The weakness is classified under CWE-330, which covers insecure randomness usage. The National Vulnerability Database rates the issue as Critical, assigning it a CVSS score of 9.1. This high severity reflects the ease with which an attacker can gain unauthorized access. The predictability of the time-based seed means that the entropy is too low for security-sensitive data like passwords.
Who is affected
Any organisation running Omnispace Agora Project versions earlier than 26.10.0 is exposed to this risk. The vulnerability specifically impacts the creation of temporary or default accounts. If an attacker can observe or estimate when a new account is being created, they can calculate the corresponding password. This allows them to take over the account before the intended user has a chance to secure it with a unique credential.
What happens next
The source material does not state whether a fix or update exists for this vulnerability. Users running affected versions should treat new default accounts as potentially compromised if their creation time is visible or guessable. Security teams should monitor for unusual login activity on newly created accounts, particularly those that have not yet been accessed by the legitimate owner. Until a fix is confirmed, manual intervention may be required to secure these credentials.
Why this attack works
Teams usually encounter this class of issue when applications use time-based seeds for cryptographic or security-sensitive operations. The core problem is insufficient entropy; if an attacker knows the approximate generation window, they can brute-force the limited set of possible outputs. This technique serves the initial access stage of an intrusion, allowing adversaries to bypass authentication without exploiting complex logic flaws. Check whether your systems rely on predictable seeds for temporary credentials.
What to do and how to stay safe
- Identify all instances of Omnispace Agora Project running versions prior to 26.10.0 in your environment.
- Monitor authentication logs for successful logins on new accounts immediately after creation, especially from unfamiliar IP addresses.
- Enforce a policy requiring immediate password changes for any default or temporary accounts upon first use by the legitimate user.
- Review codebases for similar uses of time-based random number generators, such as uniqid(), in security-critical contexts.
Step-by-step guide: Patch Management Policy: How to Automate Fixes Without Breaking Systems
General security guidance from the Payload Report newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
What is the CVSS score for CVE-2026-63149?
The National Vulnerability Database rates CVE-2026-63149 as Critical with a CVSS score of 9.1.
Which versions of Omnispace Agora Project are affected?
All versions of Omnispace Agora Project before
