CVE-2026-4959
HIGHOpenBMB XAgent ShareServer WebSocket Endpoint share.py check_user missing authentication
Title source: cnaDescription
A vulnerability was found in OpenBMB XAgent 1.0.0. This impacts the function check_user of the file XAgentServer/application/websockets/share.py of the component ShareServer WebSocket Endpoint. Performing a manipulation of the argument interaction_id results in missing authentication. Remote exploitation of the attack is possible. The exploit has been made public and could be used. The vendor was contacted early about this disclosure but did not respond in any way.
Scores
CVSS v3
7.3
EPSS
0.0010
EPSS Percentile
28.2%
Attack Vector
NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
CISA SSVC
Vulnrichment
Exploitation
poc
Automatable
yes
Technical Impact
partial
Details
CWE
CWE-287
CWE-306
Status
published
Products (1)
OpenBMB/XAgent
1.0.0
Published
Mar 27, 2026
Tracked Since
Mar 29, 2026