MEDIUMCVSS v3.1 6.1Vulnerability
CVE-2026-63155
Omnispace Agora Project through 26.10.0 contains an open redirect vulnerability that allows remote attackers to redirect users to arbitrary external URLs by manipulating the objUrl parameter in Ctrl.php's redir() function. Attackers can craft login links with objUrl set to a malicious site, causing the application to issue an HTTP 302 redirect to that external URL, which can be abused for phishing and credential theft.
Properties
- Severity
- MEDIUM
- Nvd fetched at
- 2026-11-14T00:40:25.638091+00:00
- Cvss score
- 6.1
- Cvss severity
- MEDIUM
- Retrieved at
- 2026-11-14T00:50:05+00:00
- Score
- 6.1
- Last source
- NVD
- Cvss version
- 3.1
- Cve id
- CVE-2026-63155
- Cvss vector
- CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
- First seen by Signal
- 2026-11-13T17:31:47+00:00
- Vector
- CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
- Published at
- 2026-11-13T17:17:33.710
- Last modified
- 2026-11-13T18:17:44.770
Related Entities (1)
HAS_WEAKNESS (1)
Related research
Explore deeper with Ninja Signal's threat intelligence graph