The vulnerability in Omnispace Agora Project before version 26.10.0 allows an attacker to compute the password‑reset token by hashing the user’s login and password together with SHA‑1. Because the token is deterministic and reusable, an unauthenticated attacker who knows or can guess a user’s credentials can reconstruct the valid token and forge a reset request, thereby taking over that account. The impact is the loss of confidentiality and integrity of the user’s account and potentially the entire application, as any account can be hijacked without authentication. The weakness is characterized by CWE‑640, indicating predictable use of a cryptographic function on user credentials.

Any installation of Omnispace Agora Project running a version earlier than 26.10.0 is affected. The issue is tied to the password‑reset functionality and applies to all user accounts regardless of privilege level.

The vulnerability has a CVSS score of 9.1, indicating critical severity. The EPSS score is less than 1 % and the vulnerability is not listed in CISA’s KEV catalog, suggesting a low current exploitation probability. Nevertheless, the attack vector is remote and requires no special privileges; an unauthenticated attacker can simply submit a crafted password‑reset request if they have guessed the correct login and password. Because the reset token is reproducible, the risk to any account with known or guessable credentials is high.