Dashboard / CVE-2026-4958

CVE-2026-4958

LOW
INFO Priority: 0.01 BB Relevance: 53/100
Published: 2026-03-27 Modified: 2026-10-26 First seen: 2026-10-29 Status: active

Attack Surface

Network Low Complexity No Interaction

CVSS Vector Breakdown

AV: Network
AC: High
PR: Low
UI: None
S: X
AT: None
VC: Low
VI: None
VA: None

Description

A vulnerability has been found in OpenBMB XAgent 1.0.0. This affects the function ReplayServer.on_connect/ReplayServer.send_data of the file XAgentServer/application/websockets/replayer.py of the component WebSocket Endpoint. Such manipulation of the argument interaction_id leads to authorization bypass. The attack may be launched remotely. Attacks of this nature are highly complex. The exploitability is reported as difficult. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

Weakness Classification (2)

Affected Software (1)

VendorProductVersion
openbmb xagent 1.0.0

References & Advisories (4)

https://vuldb.com/?ctiid.353835
Permissions Required VDB Entry
https://vuldb.com/?id.353835
Permissions Required VDB Entry
https://vuldb.com/?submit.777618
Issue Tracking Third Party Advisory

Bug Bounty Relevance

53 / 100
✓ Network accessible
✓ Low complexity
✓ No user interaction

CVSS Score

1.3 / 10.0 v4.0
CVSS:4.0/AV:N/AC:H/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

EPSS — Exploitation Probability

0.40%
Raw Score 0.003980
Percentile 33.9%
Date 2026-10-29

EPSS Trend

2026-10-29
0.00398
2026-10-28
0.00398

Intelligence Sources

nvd ref →

External Links