The Agora Project versions prior to 26.10.0 contain a reflected cross‑site scripting flaw that allows an attacker to inject malicious HTML or JavaScript into the browser of any user who visits a specially crafted URL. The vulnerability arises because the visioUrl query parameter bypasses the URL‑sanitizing branch of the request filter and is decoded after filtering, giving the attacker an attribute breakout payload that can execute arbitrary JavaScript before authentication. This flaw can lead to session hijacking, credential theft, defacement, or other malicious behaviors executed solely within the victim’s browser context.

All installations of Omnispace Agora Project dated earlier than version 26.10.0 are vulnerable. The problem is confined to the visioUrl parameter handling in the application core; other product modules and components are not directly affected.

The CVSS score of 5.1 indicates a moderate risk level; the EPSS score is below 1%, showing low predicted exploitation activity. The vulnerability is not listed in the CISA KEV catalog. Attackers can exploit it by crafting a URL that contains a malicious payload in the visioUrl parameter. Unauthenticated users who click such a link will have JavaScript executed in their browser with the privileges of the victim. The exploit requires only that a user navigate to the URL, so social engineering or phishing campaigns could be used. The remediation is available and straightforward, but the impact on user sessions and potential data exposure warrants prompt action.