Description
Omnispace Agora Project through 26.10.0 contains a predictable token generation vulnerability that allows unauthenticated attackers to forge the shared-calendar iCal share token by deriving md5Id() from predictable fields such as object creation time, which is self-disclosed through autorDate and the iCal CREATED field. Attackers can compute the creation minute and forge the md5Id token to access and read a shared calendar's iCal feed without authorization.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Omnispace | Agora Project | 0 ≤26.10.0 | — |