OpenBMB Internet of Agents WebSocket Connection Manager app.py ConnectionManager.connect missing authentication
- Exploited
- No known exploitation
- Fix
- No fix listed
- Who is exposed
- Not reported
- Published
- Last modified
- A 0-100 score for how much a CVE matters across the industry: exploitation, exposure, how widely the software is used, severity and whether a fix exists.What do these mean? →
- 32/100 · provisional
- Whether working attack code is public (Exploit-DB, Metasploit, Nuclei or GitHub). Public code makes attacks easier.What do these mean? →
- None on Exploit-DB, Metasploit or GitHub
- Exploitation: none
- Automatable: yes
- Technical impact: partial
Summary
OpenBMB Internet of Agents' WebSocket Connection Manager is missing authentication in its connect function, so manipulating the agent_name argument lets an attacker gain access without authenticating, with limited impact to confidentiality, integrity, and availability. The flaw can be reached remotely over the network, without logging in.
Written by anthropic/claude-haiku-5.5 from the sources below. Verify against them.
Read the original description
A security flaw has been discovered in OpenBMB Internet of Agents up to 9d78e88e47160eb42ee1ee8538c05e1c2c47877a. This affects the function ConnectionManager.connect of the file im_server/app.py of the component WebSocket Connection Manager. The manipulation of the argument agent_name results in missing authentication. It is possible to launch the attack remotely. The exploit has been released to the public and may be used for attacks. This product takes the approach of rolling releases to provide continious delivery. Therefore, version details for affected and updated releases are not available. The project was informed of the problem early through an issue report but has not responded yet.
cve.now Index
- Exploitation0/40No signal
- Exposure20/25No login or user action needed per the CVSS vector, CISA rates it automatable · Unknown: No advisory context yet
- Reach?/20Unknown. No tracked technology or package matched
- Severity6.9/10CVSS 6.9
- No patch5/5No patch listed yet
What would change the score
- Would score about 77 if added to CISA KEV
- Would score about 72 if CISA's SSVC rates exploitation active
- Would score about 37 if advisories confirm default setups are exposed
Timeline
- CVE published
- First seen by cve.now
- CISA SSVC assessment
Exploitation: none · Automatable: yes · Technical impact: partial
- Record last updated
Affected versions
- OpenBMB Internet of Agents
Version range not reported
Evidence 5
- Advisory
- Advisory
- Advisory
- Advisory
- Exploit
Corrections
None so far.
Something wrong on this page? Report an error. Every fix is listed here.