CVE-2026-123094 · Runtime
NO FIX YET · SEE WHAT TO DO
Huginn marks OAuth service display names as safe HTML without escaping them, so a crafted nickname, name or email from a connected OAuth account is stored and rendered as script. An attacker who can log in can run JavaScript in the browser of a user who attaches that account to an agent, including an administrator, exposing credentials, agents and events.
first public Nov 4, 2026 · 1 source
Check it with your coding agent
It checks your repository and tells you if you’re affected, with the fix.
Self-hosted Huginn instances that let users connect OAuth accounts and share them globally. Exposure needs an authenticated account that can create a crafted OAuth connection, and a victim who attaches it to an agent and views it. Instances that restrict OAuth connections to trusted users have a smaller exposure.
Not affected if no-oauth-connections, version-2026.11.05-or-later
Who cares huginn, oauth, self-hosted
huginn release before 2026.11.05 is affected.2026.11.05 or later.Huginn before 2026.11.05 contains a stored cross-site scripting vulnerability in the service_label helper that marks unescaped OAuth service display names as html_safe. Authenticated attackers can connect an OAuth account with a crafted nickname, name or email and share it globally, executing JavaScript when victims attach it to Agents and view them, exposing Credentials, Agents and Events, and admin actions if the victim is an administrator.
Are you affected?
Tell InfraStack what you run. It checks this one, and every next one, against your stack.
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
This page as .md · .json · CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.