EUVD-2026-16692Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
Lifecycle Timeline
5DescriptionCVE.org
A vulnerability was found in OpenBMB XAgent 1.0.0. This impacts the function check_user of the file XAgentServer/application/websockets/share.py of the component ShareServer WebSocket Endpoint. Performing a manipulation of the argument interaction_id results in missing authentication. Remote exploitation of the attack is possible. The exploit has been made public and could be used. The vendor was contacted early about this disclosure but did not respond in any way.
AnalysisAI
OpenBMB XAgent 1.0.0 ShareServer WebSocket endpoint allows remote authentication bypass through manipulation of the interaction_id parameter in the check_user function, enabling unauthenticated attackers to access protected resources with low confidentiality, integrity, and availability impact. Publicly available exploit code exists, the vendor was contacted but did not respond, and active exploitation remains possible.
Technical ContextAI
The vulnerability exists in the ShareServer WebSocket endpoint component (XAgentServer/application/websockets/share.py) where the check_user function fails to properly validate the interaction_id argument. This represents a CWE-306 (Missing Authentication for Critical Function) flaw, a root cause category where security-critical operations lack adequate access controls. The affected product is OpenBMB XAgent (cpe:2.3:a:openbmb:xagent:*:*:*:*:*:*:*:*), specifically version 1.0.0. The vulnerability manifests in a WebSocket-based sharing mechanism where parameter manipulation allows the authentication check to be bypassed entirely, granting unauthenticated access to functions that should require prior authentication.
RemediationAI
Immediate patching is the primary mitigation; however, no vendor-released patch has been identified at the time of analysis, and the vendor has not responded to early disclosure. Until a patch is available, implement the following controls: (1) Disable or isolate the ShareServer WebSocket endpoint if not operationally required; (2) Restrict network access to the WebSocket service to trusted IP ranges using firewall rules or network segmentation; (3) Deploy a reverse proxy or API gateway in front of XAgent that enforces explicit authentication and authorization checks independent of the vulnerable check_user function; (4) Monitor WebSocket connections for suspicious interaction_id manipulation patterns and alert on unauthenticated access attempts; (5) Review logs for unauthorized access to interaction resources. Given vendor non-responsiveness, consider forking or patching the open-source codebase directly if operationally feasible. Contact OpenBMB through alternative channels (GitHub issues, community forums) to escalate patch delivery.
A vulnerability was found in OpenBMB XAgent 1.0.0. Rated high severity (CVSS 8.8), this vulnerability is low attack comp
OpenBMB XAgent 1.0.0 allows authenticated remote attackers to bypass authorization controls via manipulation of the inte
Path traversal vulnerability in OpenBMB XAgent up to version 1.0.0 allows attackers to read arbitrary files via the /con
OpenBMB XAgent 1.0.0 exposes sensitive API credentials in log files through improper handling of the api_key argument in
Same technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today