Evidence · DiggingBeagle record
OpenBMB IoA issue 17, unauthenticated websocket agent takeover
- Source role
- primary disclosure
Evidence record
Claim-level citations (1)
- supportsIoA accepted a second WebSocket connection as an existing agent: Issue 17 reproduces that a second unauthenticated websocket connection to /ws/{agent_name} replaces the first and can send messages with a forged sender field.
Issue #17, Summary, Root cause and Steps to reproduce