CVE-2026-4958: OpenBMB XAgent WebSocket Endpoint replayer.py ReplayServer.send_data authorization
A vulnerability has been found in OpenBMB XAgent 1.0.0. This affects the function ReplayServer.onconnect/ReplayServer.senddata of the file XAgentServer/application/websockets/replayer.py of the component WebSocket Endpoint. Such manipulation of the argument interactionid leads to authorization bypass. The attack may be launched remotely. Attacks of this nature are highly complex. The exploitability is reported as difficult. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-4958?
CVE-2026-4958 has been classified as a high severity vulnerability due to its potential to allow unauthorized access to sensitive data.
How do I fix CVE-2026-4958?
To fix CVE-2026-4958, update to the latest version of OpenBMB XAgent that addresses this vulnerability.
What specific components are affected by CVE-2026-4958?
CVE-2026-4958 affects the ReplayServer.on_connect and ReplayServer.send_data functions in the replayer.py file of the WebSocket component.
Can CVE-2026-4958 be exploited remotely?
Yes, CVE-2026-4958 can be potentially exploited remotely, allowing an attacker to access the application's WebSocket endpoint.
What is the impact of CVE-2026-4958 on security?
The impact of CVE-2026-4958 could lead to unauthorized operations, data leakage, or privilege escalation, compromising the overall security of the application.