Security Resilience

CVE-2026-63158

Public PoC
Published
13 October 2026
Modified
15 October 2026
CVSS Score v4 9.1
Click a component to see what it means
Raw vectorCVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
EPSS Score 0.0041 34th percentile
Risk Priority 36 floored blend · peak EPSS

CVSS and EPSS are reproduced from their sources (NVD, FIRST EPSS). Risk Priority is our own derived reading, not an NVD score.

Summary

CVE-2026-63158 is a critical-severity Use of Password Hash Instead of Password for Authentication (CWE-836) vulnerability in Agora Project (inferred from references). Its CVSS base score is 9.1 (Critical).

Operationally, exploitation aligns with the MITRE ATT&CK technique Pass the Hash (T1550.002); ranked at the 34th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.

The strongest mitigations our analysis identified map to IA-2 (Identification and Authentication (Organizational Users)) and IA-5 (Authenticator Management) — see the control section below for these in your framework.

EU & UK References

Vulnerability Data

Omnispace Agora Project before 26.10.0 contains an authentication bypass vulnerability that allows attackers possessing a user's stored bcrypt password hash to authenticate as that user without knowing the actual password, caused by the legacy AGORAP_LOG/AGORAP_PASS cookie mechanism treating the stored…

more

hash as a directly replayable bearer credential. Attackers can set the AGORAP_LOG/AGORAP_PASS cookies with a stolen password hash to impersonate any user, including administrators, and gain unauthorized access to the application.

CWE(s)
CWE-836

Related Threats

MITRE ATT&CK Enterprise Techniques

T1550.002 Pass the Hash Lateral Movement
Adversaries may “pass the hash” using stolen password hashes to move laterally within an environment, bypassing normal system access controls.
attack.mitre.org →
T1003.007 Proc Filesystem Credential Access
Adversaries may gather credentials from the proc filesystem or `/proc`.
attack.mitre.org →
T1005 Data from Local System Collection
Adversaries may search local system sources, such as file systems, configuration files, local databases, virtual machine files, or process memory, to find files of interest and sensitive data prior to Exfiltration.
attack.mitre.org →
T1007 System Service Discovery Discovery
Adversaries may try to gather information about registered local system services.
attack.mitre.org →
T1014 Rootkit Stealth
Adversaries may use rootkits to hide the presence of programs, files, network connections, services, drivers, and other system components.
attack.mitre.org →
T1016 System Network Configuration Discovery Discovery
Adversaries may look for details about the network configuration and settings, such as IP and/or MAC addresses, of systems they access or through information discovery of remote systems.
attack.mitre.org →
Derived from this CVE’s CWE(s) via the direct CWE→ATT&CK cross-walk.

CVEs Like This One

CVE-2026-9222Shared CWE-836
CVE-2026-40103Shared CWE-836
CVE-2023-39546Shared CWE-836
CVE-2019-25552Shared CWE-836
CVE-2025-64471Shared CWE-836
CVE-2023-4299Shared CWE-836
CVE-2025-48925Shared CWE-836
CVE-2025-52543Shared CWE-836
CVE-2023-34132Shared CWE-836
CVE-2023-23450Shared CWE-836

Affected Assets

Agora Project
—
inferred from references and description; NVD did not file a CPE for this CVE

Mitigating Controls

Mitigating Controls (NIST 800-53 r5) AI

IA-2 Identification and Authentication (Organizational Users) partial match

Requires proper identification and authentication of users, which structurally precludes accepting password hashes in place of passwords.

IA-5 Authenticator Management partial match

Authenticator management requires secure distribution, verification, and handling of passwords rather than allowing direct submission and comparison of hashes.

Mitigating Controls (NIST CSF 2.0) AI

Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.

PR.AA-03 partial match
blocks

Proper authentication mechanisms require passwords (not pre-hashed values) to be supplied by the claimant and verified server-side.

Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI

Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.

A.5.17 Authentication information partial match
degrades

Directly requires secure handling and protection of authentication credentials, preventing storage or comparison of password hashes as if they were passwords.

A.8.24 Use of cryptography partial match
degrades

Requires proper cryptographic practices for protecting passwords, indirectly mitigating misuse of hashes in authentication.

A.8.26 Application security requirements partial match
removes
A.8.27 Secure system architecture and engineering principles partial match
removes
A.8.28 Secure coding partial match
prevents

Secure coding guidance can prevent this implementation error but does not address the control's broader intent.

A.8.5 Secure authentication partial match
blocks

A.8.5 chooses and strengthens authentication techniques (including MFA, log-on hardening, and brute-force protection) but never addresses storing or comparing a password hash in place of the actual password; the weakness can still be present and exploitable when the control is fully met.

References