CVE-2026-4959: OpenBMB XAgent ShareServer WebSocket Endpoint share.py check_user missing authentication

Published Mar 27, 2026

Updated

A vulnerability was found in OpenBMB XAgent 1.0.0. This impacts the function checkuser of the file XAgentServer/application/websockets/share.py of the component ShareServer WebSocket Endpoint. Performing a manipulation of the argument interactionid results in missing authentication. Remote exploitation of the attack is possible. The exploit has been made public and could be used. The vendor was contacted early about this disclosure but did not respond in any way.

Affected Software

2 affected components

OpenBMB OpenBMB XAgent=1.0.0

OpenBMB XAgent=1.0.0

Event History

Mar 27, 2026

CVE Published

via MITRE·03:31 PM

Data Sourced

via MITRE·03:31 PM

DescriptionSeverityWeakness

Data Sourced

via NVD·04:16 PM

DescriptionSeverityWeaknessAffected Software

Frequently Asked Questions

What is the severity of CVE-2026-4959?

CVE-2026-4959 has been classified as a moderate severity vulnerability due to the missing authentication in the check_user function.

How do I fix CVE-2026-4959?

To fix CVE-2026-4959, implement proper authentication checks in the check_user method in the share.py file.

What systems are affected by CVE-2026-4959?

CVE-2026-4959 affects OpenBMB XAgent version 1.0.0 specifically.

What type of vulnerability is CVE-2026-4959?

CVE-2026-4959 is an authentication-related vulnerability impacting the ShareServer WebSocket Endpoint.

Can CVE-2026-4959 be exploited remotely?

Yes, CVE-2026-4959 can be exploited remotely due to the lack of authentication in the WebSocket endpoint.