The Omnispace Agora Project contains a session fixation flaw that allows remote attackers to plant a known session identifier in a victim’s browser before the victim logs in. Because the application does not regenerate the session ID after successful authentication, the attacker can later impersonate the victim and access the authenticated session without having to obtain the victim’s credentials.

All instances of Omnispace Agora Project with a version earlier than 26.10.0 are vulnerable; no specific build numbers are listed, so any installation older than 26.10.0 should be considered at risk.

With a CVSS score of 8.6, the vulnerability is high severity. The EPSS score of less than 1% indicates a low but non‑zero chance of exploitation in the wild, and the vulnerability is not listed in the CISA KEV catalog. Attackers are likely to gain access by delivering a malicious page that sets the session cookie or by manipulating the cookie directly, then waiting for a victim to authenticate. Once the victim logs in, the attacker can hijack the session and perform actions as the victim within the application.