The vulnerability arises because the application stores the persistent remember‑me token in plaintext on the server. The value stored in the database is identical to the token presented in the user’s cookie. This flaw allows an attacker who obtains the database or backups to capture the token and replay it to authenticate as the victim without knowing their password. The weakness is a direct credential disclosure, identified as CWE‑522.

The affected product is Omnispace Agora Project versions earlier than 26.10.0. Systems running any of those releases are susceptible, including any instance that has not applied the 26.10 update.

With a CVSS score of 9.1, this is a high‑severity flaw. The EPSS score indicates a very low probability of exploitation, but the impact is severe if the token is compromised. Attackers could obtain the token through database access or compromise of backups. Once acquired, replaying the token grants full authentication as the user. The flaw is not currently listed in the CISA KEV catalog.