The vulnerability resides in the check_user function of the ShareServer WebSocket Endpoint. By manipulating the interaction_id parameter, an attacker can bypass authentication checks, enabling unauthorized users to access operations normally restricted to authenticated clients. This leads to potential unauthorized configuration changes, data exposure, or other privileged actions, classified as authentication bypass and missing authentication weaknesses (CWE‑287 and CWE‑306).

OpenBMB XAgent version 1.0.0 is affected. Users running this version on any host exposing the ShareServer WebSocket Endpoint are vulnerable.

The CVSS base score is 6.9, reflecting a moderate to high severity. EPSS score is not available and the issue is not listed in the CISA KEV catalog, but the publicly available exploit and remote attack vector increase the likelihood of real-world exploitation. Attackers can reach the vulnerable endpoint over the network, manipulate interaction_id and gain unauthorized access. The impact ranges from configuration tampering to potential data exfiltration, depending on the operations exposed by the endpoint.