Comment 6 for bug 430697

Yes, XAUTH is needed but we're talking about XHOST that's causing problems. Causing problems not only with exmh but each and every Tk application using the send function to communicate with its child windows.

From the Tk send man page:

"In order to provide at least a small amount of security, Tk checks the access control being used by the server and rejects incoming sends unless (a) xhost-style access control is enabled (i.e. only certain hosts can establish connections) and (b) the list of enabled hosts is empty. This means that applications cannot connect to your server unless they use some other form of authorization such as that provide by xauth."

So this bug is still valid as for some reasons there are entried added into the XHOST list which aren't necessary in any way, in fact, all systems I'm using run fine with an empty XHOST list since XAUTH has been invented some ten years ago.