CVE-2026-49410
8.1HighPublished 16 Oct 2026 · NVD status: Received · AI triage by gemini-3.8-flash
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- Required
- Impact
- High impact on confidentiality, integrity
- Weakness
- CWE-352, CWE-384
Impact
Attackers can hijack a local user's active session, gaining access to subsequent agent actions, memory writes, and Telegram messages. This requires tricking a victim with OpenHuman running locally into visiting a malicious website.
Root cause
The loopback callback endpoint GET /auth/telegram lacks origin and browser fetch metadata validation, allowing CSRF attacks to overwrite the stored local JWT session with an attacker-provided login token.
Affected systems
OpenHuman versions before 0.56.0
CVSS v3.1 · CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N
Fix & remediation
Upgrade OpenHuman to version 0.56.0 or later. If upgrading immediately is not possible, stop the OpenHuman desktop app or block web browsers from initiating requests to loopback port 7788.
$ cargo install openhuman --version 0.56.0AI-suggested. Run it in staging first and check it against the vendor advisory. Why?
NVD description
OpenHuman is an open-source agent harness available as a desktop application and Rust library. Versions before 0.56.0 allow cross-site request forgery against the unauthenticated GET /auth/telegram loopback callback because telegram_auth_handler consumes an attacker-supplied one-time Telegram login token and passes the returned JWT to credentials::ops::store_session without validating browser fetch metadata or the request origin. An attacker with an OpenHuman account can cause a user with the local core running to visit a malicious page that requests the /auth/telegram endpoint on loopback port 7788, switching the user's active local session to the attacker's backend account and exposing subsequent agent actions, memory writes, and Telegram messages associated with that session to the attacker. This issue is fixed in version 0.56.0.