---
id: "CVE-2026-63155"
page: "https://infrastack.ai/live/CVE-2026-63155"
kind: "vulnerability"
aliases: ["CVE-2026-63155"]
title: "Omnispace Agora Project: open redirect lets attackers send users to any site"
severity: "medium"
cvss: 6.1
epss: null
exploited: false
status: "open"
category: "other"
products: []
ecosystems: []
tags: ["omnispace-agora", "other"]
not_affected_if: []
published_at: "2026-11-13T17:17:33+00:00"
first_seen_at: "2026-11-13T17:48:02+00:00"
updated_at: "2026-11-13T17:49:02+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-63155", "first_seen_at": "2026-11-13T17:48:02+00:00"}]
exploit_sources: []
---

# Omnispace Agora Project: open redirect lets attackers send users to any site

Link for people: https://infrastack.ai/live/CVE-2026-63155 (this .md is for agents)

Omnispace Agora Project through 26.10.0 redirects users to any external URL given in the objUrl parameter of Ctrl.php's redir() function. An attacker can use crafted login links to send victims to a phishing or credential-theft site.

_Summary, check and fix written by a model from the sources; labelled as such._

## Timeline

- 2026-11-13T17:48:02+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-63155

## From the sources

Omnispace Agora Project through 26.10.0 contains an open redirect vulnerability that allows remote attackers to redirect users to arbitrary external URLs by manipulating the objUrl parameter in Ctrl.php's redir() function. Attackers can craft login links with objUrl set to a malicious site, causing the application to issue an HTTP 302 redirect to that external URL, which can be abused for phishing and credential theft.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_