{"id":"CVE-2026-63155","kind":"vulnerability","aliases":["CVE-2026-63155"],"related":[],"title":"Omnispace Agora Project: open redirect lets attackers send users to any site","description":"Omnispace Agora Project through 26.10.0 contains an open redirect vulnerability that allows remote attackers to redirect users to arbitrary external URLs by manipulating the objUrl parameter in Ctrl.php's redir() function. Attackers can craft login links with objUrl set to a malicious site, causing the application to issue an HTTP 302 redirect to that external URL, which can be abused for phishing and credential theft.","summary":"Omnispace Agora Project through 26.10.0 redirects users to any external URL given in the objUrl parameter of Ctrl.php's redir() function. An attacker can use crafted login links to send victims to a phishing or credential-theft site.","severity":"medium","cvss":6.1,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["omnispace-agora","other"],"not_affected_if":[],"how_to_check":null,"fix":null,"status":"open","published_at":"2026-11-13T17:17:33+00:00","first_seen_at":"2026-11-13T17:48:02+00:00","triaged_at":"2026-11-13T17:49:02+00:00","updated_at":"2026-11-13T17:49:02+00:00","category":"other","confidence":0.6,"triage":{"at":"2026-11-13T17:49:02Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"internet","title":"Omnispace Agora Project: open redirect lets attackers send users to any site","impact":"low","summary":"Omnispace Agora Project through 26.10.0 redirects users to any external URL given in the objUrl parameter of Ctrl.php's redir() function. An attacker can use crafted login links to send victims to a phishing or credential-theft site.","audience":"businesses","category":"other","nicknames":[],"who_cares":["omnispace-agora"],"confidence":0.6,"fix_status":"unknown","needs_auth":"unknown","worst_case":"victims are redirected to phishing pages that harvest credentials","analyst_note":"Confirm the fixed version and whether Ctrl.php redir() is reachable by default, using the vendor's release notes or the NVD entry.","how_to_check":"- unknown","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":[],"who_is_affected":"Deployments of Omnispace Agora Project up to and including 26.10.0 that expose the Ctrl.php redir() endpoint. The sources do not say whether any configuration or authentication changes the exposure.","user_interaction":"yes","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"unknown"},"cost_usd":0.000679,"input_tokens":4597,"output_tokens":438,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-2026':14A,17A '-63155':15A,18A '26.10.0':26B,65C '302':111C 'abus':120C 'agora':2A,21B,23B,62C 'allow':72C 'applic':106C 'arbitrari':79C 'attack':7A,44B,74C,92C 'caus':104C 'contain':66C 'craft':47B,94C 'credenti':58B,124C 'credential-theft':57B 'ctrl.php':39B,88C 'cve':13A,16A 'extern':31B,80C,115C 'function':42B,91C 'given':33B 'http':110C 'issu':108C 'let':6A 'link':49B,96C 'login':48B,95C 'malici':102C 'manipul':83C 'objurl':36B,85C,98C 'omnispac':1A,20B,22B,61C 'omnispace-agora':19B 'open':4A,68C 'paramet':37B,86C 'phish':55B,122C 'project':3A,24B,63C 'redir':41B,90C 'redirect':5A,27B,69C,76C,112C 'remot':73C 'send':8A,51B 'set':99C 'site':12A,60B,103C 'theft':59B,125C 'url':32B,81C,116C 'use':46B 'user':9A,28B,77C 'victim':52B 'vulner':70C","nicknames":[],"mitigations":[],"who_affected":"Deployments of Omnispace Agora Project up to and including 26.10.0 that expose the Ctrl.php redir() endpoint. The sources do not say whether any configuration or authentication changes the exposure.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["medium","omnispaceagora","other"],"campaign_type":null,"search_a":"'-2026':14A,17A '-63155':15A,18A 'agora':2A 'attack':7A 'cve':13A,16A 'let':6A 'omnispac':1A 'open':4A 'project':3A 'redirect':5A 'send':8A 'site':12A 'user':9A","search_b":"'26.10.0':26B 'agora':21B,23B 'attack':44B 'craft':47B 'credenti':58B 'credential-theft':57B 'ctrl.php':39B 'extern':31B 'function':42B 'given':33B 'link':49B 'login':48B 'objurl':36B 'omnispac':20B,22B 'omnispace-agora':19B 'paramet':37B 'phish':55B 'project':24B 'redir':41B 'redirect':27B 'send':51B 'site':60B 'theft':59B 'url':32B 'use':46B 'user':28B 'victim':52B","search_c":"'26.10.0':65C '302':111C 'abus':120C 'agora':62C 'allow':72C 'applic':106C 'arbitrari':79C 'attack':74C,92C 'caus':104C 'contain':66C 'craft':94C 'credenti':124C 'ctrl.php':88C 'extern':80C,115C 'function':91C 'http':110C 'issu':108C 'link':96C 'login':95C 'malici':102C 'manipul':83C 'objurl':85C,98C 'omnispac':61C 'open':68C 'paramet':86C 'phish':122C 'project':63C 'redir':90C 'redirect':69C,76C,112C 'remot':73C 'set':99C 'site':103C 'theft':125C 'url':81C,116C 'user':77C 'vulner':70C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-13T17:17:33+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-63155","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-63155","severity":null,"published_at":"2026-11-13T17:17:33+00:00","modified_at":"2026-11-13T17:17:33+00:00","first_seen_at":"2026-11-13T17:48:02+00:00","fetched_at":"2026-11-13T17:48:02+00:00","note":null}],"documents":[],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}