CVE-2026-4958 | OpenBMB XAgent 1.0.0 WebSocket Endpoint replayer.py ReplayServer.on_connect/ReplayServer.send_data interaction_id authorization

A vulnerability described as problematic has been identified in OpenBMB XAgent 1.0.0. This affects the function ReplayServer.on_connect/ReplayServer.send_data of the file XAgentServer/application/websockets/replayer.py of the component WebSocket Endpoint. Such manipulation of the argument interaction_id leads to authorization bypass.

This vulnerability is traded as CVE-2026-4958. The attack may be launched remotely. Furthermore, there is an exploit available.

The vendor was contacted early about this disclosure but did not respond in any way.