CVE-2026-4959
Published: 27 March 2026
Summary
CVE-2026-4959 is a high-severity Improper Authentication (CWE-287) vulnerability. Its CVSS base score is 7.3 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked in the top 47.8% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 AC-14 (Permitted Actions Without Identification or Authentication) and AC-3 (Access Enforcement).
Threat & Defense at a Glance
Threat & Defense Details
Mitigating Controls (NIST 800-53 r5)AI
Enforces approved authorizations for access to system resources, directly requiring authentication checks in the check_user function to block unauthorized WebSocket access via interaction_id manipulation.
Identifies and authorizes only specific actions without identification or authentication, preventing critical ShareServer WebSocket functions from operating without required checks.
Protects the authenticity of WebSocket communication sessions, mitigating unauthorized remote exploitation of the missing authentication vulnerability.
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Missing authentication on a public-facing WebSocket endpoint (ShareServer) allows unauthenticated remote network exploitation by manipulating interaction_id, directly matching T1190 Exploit Public-Facing Application.
NVD Description
A vulnerability was found in OpenBMB XAgent 1.0.0. This impacts the function check_user of the file XAgentServer/application/websockets/share.py of the component ShareServer WebSocket Endpoint. Performing a manipulation of the argument interaction_id results in missing authentication. Remote exploitation of the attack is…
more
possible. The exploit has been made public and could be used. The vendor was contacted early about this disclosure but did not respond in any way.
Deeper analysisAI
CVE-2026-4959 is a missing authentication vulnerability in OpenBMB XAgent version 1.0.0. It affects the check_user function within the file XAgentServer/application/websockets/share.py of the ShareServer WebSocket Endpoint. The flaw is triggered by manipulation of the interaction_id argument, leading to improper authentication checks.
Remote attackers require no privileges and can exploit this over the network with low attack complexity. Successful exploitation grants limited impacts to confidentiality, integrity, and availability, as reflected in its CVSS v3.1 base score of 7.3 (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L). The issue maps to CWE-287 (Improper Authentication) and CWE-306 (Missing Authentication for Critical Function).
VulDB advisories note that the vendor was contacted early for disclosure but provided no response, and no patches are referenced. An exploit is publicly available via a GitHub gist, enabling immediate remote exploitation attempts.
Details
- CWE(s)