CVE-2026-4958

LOW

OpenBMB XAgent WebSocket Endpoint replayer.py ReplayServer.send_data authorization

Title source: cna
STIX 2.1

Description

A vulnerability has been found in OpenBMB XAgent 1.0.0. This affects the function ReplayServer.on_connect/ReplayServer.send_data of the file XAgentServer/application/websockets/replayer.py of the component WebSocket Endpoint. Such manipulation of the argument interaction_id leads to authorization bypass. The attack may be launched remotely. Attacks of this nature are highly complex. The exploitability is reported as difficult. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

References (4)

Core 4
Core References
Vdb Entry, Technical Description vdb-entry technical-description
VDB-353835 | OpenBMB XAgent WebSocket Endpoint replayer.py ReplayServer.send_data authorization
https://vuldb.com/?id.353835
Signature, Permissions Required signature permissions-required
VDB-353835 | CTI Indicators (IOB, IOC, IOA)
https://vuldb.com/?ctiid.353835
Third Party Advisory third-party-advisory
Submit #777618 | OpenBMB XAgent v1.0.0 Authorization Bypass Through User-Controlled Key (CWE-639)
https://vuldb.com/?submit.777618

Scores

CVSS v3 3.1
EPSS 0.0038
EPSS Percentile 29.9%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N

CISA SSVC

Vulnrichment
Exploitation poc
Automatable no
Technical Impact partial

Details

CWE
CWE-285 CWE-639
Status published
Products (2)
openbmb/xagent 1.0.0
OpenBMB/XAgent 1.0.0
Published Mar 27, 2026
Tracked Since Mar 29, 2026