The Agora Project releases before version 26.10.0 generate temporary or default passwords using PHP’s uniqid() with microsecond‑level server time, making those passwords discoverable by attackers who can approximate the account creation time. This flaw allows an attacker to predict the account’s password and log in before the legitimate user, effectively bypassing authentication without needing code execution or elevated privileges. The weakness is a predictable random number generator, documented as CWE‑330.

Omnispace Agora Project versions earlier than 26.10.0 are affected. The vulnerability was disclosed through the Agora Project’s public code repository and website, and applies to all deployments of these earlier releases.

This vulnerability carries a CVSS score of 9.1, indicating a high‑severity breach that could lead to full account compromise and potential system control. The EPSS score is not available, and the issue is not listed in the CISA KEV catalog, but the flaw’s inherent predictability means that if an attacker can observe or approximate the time an account is created, it is straightforward to compute the password. The likely attack vector is remote, through exposed account‑creation or default‑account assignment interfaces. Given the high CVSS and the ease of exploitation, the risk remains significant for all affected deployments.