CVE-2026-4959 | OpenBMB XAgent 1.0.0 ShareServer WebSocket Endpoint share.py check_user interaction_id missing authentication

A vulnerability classified as critical has been found in OpenBMB XAgent 1.0.0. This impacts the function check_user of the file XAgentServer/application/websockets/share.py of the component ShareServer WebSocket Endpoint. Performing a manipulation of the argument interaction_id results in missing authentication.

This vulnerability is known as CVE-2026-4959. Remote exploitation of the attack is possible. Furthermore, an exploit is available.

The vendor was contacted early about this disclosure but did not respond in any way.