A vulnerability was found in OpenBMB XAgent 1.0.0. This impacts the function check_user of the file XAgentServer/application/websockets/share.py of the componen…

A critical authentication bypass vulnerability was discovered in OpenBMB XAgent 1.0.0, specifically in the check_user function of the ShareServer WebSocket Endpoint. The vulnerability allows remote attackers to manipulate the interaction_id argument to bypass authentication mechanisms. The exploit has been publicly disclosed and is available for use. The vendor was contacted about this disclosure but has not responded. This creates a significant security risk as the vulnerability can be remotely exploited.