The vulnerability is a pass‑the‑hash authentication bypass. When an attacker obtains a stored bcrypt password hash for a user, they can set the AGORAP_LOG/AGORAP_PASS cookies with that hash, and the application will treat the cookie value as a valid bearer credential. This allows the attacker to authenticate as the user, including administrators, without knowing the actual password. The flaw originates from the legacy AGORAP_LOG/AGORAP_PASS cookie mechanism that does not perform any additional validation and therefore can be replayed directly.

Omnispace Agora Project versions earlier than 26.10.0. The issue is limited to the legacy cookie authentication mechanism within those releases, affecting the web application’s authentication module that reads the AGORAP_LOG and AGORAP_PASS cookies from incoming requests.

The CVSS score of 9.1 indicates a severe vulnerability. The EPSS score of less than 1% shows a very low current exploitation probability, and the vulnerability is not listed in the CISA KEV catalog. Nevertheless, the attack path is relatively simple: an attacker who has obtained a user’s bcrypt hash can craft an HTTP request that includes the AGORAPAP_PASS cookies set to that hash. If the target system still uses the legacy cookie scheme, the request will be accepted and the attacker will be authenticated as the victim. Because the vulnerability grants full access to the authenticated session, it can lead to complete compromise of administrative controls.