OpenBMB XAgent 1.0.0 contains a vulnerability in the ShareServer WebSocket Endpoint component, specifically in the check_user function of XAgentServer/application/websockets/share.py. Manipulating the interaction_id parameter leads to missing authentication controls, enabling remote attackers to bypass authentication mechanisms. The vulnerability is remotely exploitable without requiring privileges or user interaction. Although the exploit has been publicly released, there is no vendor response or official patch available at this time.

Successful exploitation allows remote attackers to bypass authentication on the affected OpenBMB XAgent 1.0.0 ShareServer WebSocket Endpoint, potentially granting unauthorized access to the system or its functions. This could lead to unauthorized actions or data exposure depending on the application context. The vulnerability has a CVSS 4.0 base score of 6.9 (medium severity), indicating a significant but not critical risk.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since the vendor has not responded and no patch or workaround is provided, users should consider restricting access to the vulnerable service and monitor for suspicious activity. Avoid exposing the ShareServer WebSocket Endpoint to untrusted networks until a fix is available.