{"id":"CVE-2026-123094","kind":"vulnerability","aliases":["CVE-2026-123094"],"related":[],"title":"Huginn: stored XSS in OAuth service labels runs script in victims' browsers","description":"Huginn before 2026.11.05 contains a stored cross-site scripting vulnerability in the service_label helper that marks unescaped OAuth service display names as html_safe. Authenticated attackers can connect an OAuth account with a crafted nickname, name or email and share it globally, executing JavaScript when victims attach it to Agents and view them, exposing Credentials, Agents and Events, and admin actions if the victim is an administrator.","summary":"Huginn marks OAuth service display names as safe HTML without escaping them, so a crafted nickname, name or email from a connected OAuth account is stored and rendered as script. An attacker who can log in can run JavaScript in the browser of a user who attaches that account to an agent, including an administrator, exposing credentials, agents and events.","severity":"medium","cvss":5.4,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["huginn","oauth","runtime","self-hosted"],"not_affected_if":["no-oauth-connections","version-2026.11.05-or-later"],"how_to_check":"- Check the Huginn version: `huginn` release before `2026.11.05` is affected.\n- Look for shared OAuth service connections whose display name or email contains HTML or script tags.","fix":"- Huginn: move to `2026.11.05` or later.","status":"open","published_at":"2026-11-05T16:17:46+00:00","first_seen_at":"2026-11-05T16:40:02+00:00","triaged_at":"2026-11-05T16:41:45+00:00","updated_at":"2026-11-05T16:41:45+00:00","category":"runtime","confidence":0.7,"triage":{"at":"2026-11-05T16:41:45Z","model":"claude-haiku-5-5","output":{"fix":"- Huginn: move to `2026.11.05` or later.","reach":"internet","title":"Huginn: stored XSS in OAuth service labels runs script in victims' browsers","impact":"medium","summary":"Huginn marks OAuth service display names as safe HTML without escaping them, so a crafted nickname, name or email from a connected OAuth account is stored and rendered as script. An attacker who can log in can run JavaScript in the browser of a user who attaches that account to an agent, including an administrator, exposing credentials, agents and events.","audience":"businesses","category":"runtime","nicknames":[],"who_cares":["huginn","self-hosted","oauth"],"confidence":0.7,"fix_status":"available","needs_auth":"yes","worst_case":"script runs in admin's browser, exposing credentials and agents","analyst_note":"","how_to_check":"- Check the Huginn version: `huginn` release before `2026.11.05` is affected.\n- Look for shared OAuth service connections whose display name or email contains HTML or script tags.\n- unknown","plain_action":"","needs_analyst":false,"not_affected_if":["version-2026.11.05-or-later","no-oauth-connections"],"who_is_affected":"Self-hosted Huginn instances that let users connect OAuth accounts and share them globally. Exposure needs an authenticated account that can create a crafted OAuth connection, and a victim who attaches it to an agent and views it. Instances that restrict OAuth connections to trusted users have a smaller exposure.","user_interaction":"yes","needs_special_setup":"yes","severity_if_unknown":"unknown"},"cost_usd":0.000714,"input_tokens":4338,"output_tokens":560,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-123094':15A,18A '-2026':14A,17A '2026.11.05':87C 'account':48B,73B,117C 'action':147C 'admin':146C 'administr':79B,153C 'agent':76B,82B,136C,142C 'attach':71B,133C 'attack':56B,112C 'authent':111C 'browser':12A,66B 'connect':46B,114C 'contain':88C 'craft':39B,120C 'credenti':81B,141C 'cross':92C 'cross-sit':91C 'cve':13A,16A 'display':29B,106C 'email':43B,124C 'escap':35B 'event':84B,144C 'execut':129C 'expos':80B,140C 'global':128C 'helper':100C 'host':24B 'html':33B,109C 'huginn':1A,19B,25B,85C 'includ':77B 'javascript':63B,130C 'label':7A,99C 'log':59B 'mark':26B,102C 'name':30B,41B,107C,122C 'nicknam':40B,121C 'oauth':5A,20B,27B,47B,104C,116C 'render':52B 'run':8A,62B 'runtim':21B 'safe':32B,110C 'script':9A,54B,94C 'self':23B 'self-host':22B 'servic':6A,28B,98C,105C 'share':126C 'site':93C 'store':2A,50B,90C 'unescap':103C 'user':69B 'victim':11A,132C,150C 'view':138C 'vulner':95C 'without':34B 'xss':3A","nicknames":[],"mitigations":[],"who_affected":"Self-hosted Huginn instances that let users connect OAuth accounts and share them globally. Exposure needs an authenticated account that can create a crafted OAuth connection, and a victim who attaches it to an agent and views it. Instances that restrict OAuth connections to trusted users have a smaller exposure.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["huginn","medium","oauth","runtime","selfhosted"],"campaign_type":null,"first_public_at":"2026-11-04T18:37:22+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-123094","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-123094","severity":null,"published_at":"2026-11-05T16:17:46+00:00","modified_at":"2026-11-05T16:17:46+00:00","first_seen_at":"2026-11-05T16:40:02+00:00","fetched_at":"2026-11-05T16:40:02+00:00","note":null}],"documents":[{"id":77638,"url":"https://github.com/huginn/huginn/commit/92229a5e7343bfffc740d31e42b9654b212b678b","title":"Patch: github.com","kind":"other","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Patch: github.com"},{"id":77639,"url":"https://github.com/huginn/huginn/releases/tag/v2026.11.05","title":"Release notes: github.com","kind":"release","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Release notes: github.com"},{"id":77640,"url":"https://github.com/huginn/huginn/security/advisories/GHSA-rjw9-xx87-f2ww","title":"Vendor advisory: github.com","kind":"vendor","source":"nvd","publisher":"vendor","text":null,"published_at":"2026-11-04T18:37:22+00:00","relation":"advisory","confidence":null,"note":"Vendor advisory: github.com"},{"id":77641,"url":"https://www.vulncheck.com/advisories/huginn-before-2026.11.05-stored-xss-via-oauth-service-display-name","title":"Third-party advisory: www.vulncheck.com","kind":"advisory","source":"nvd","publisher":"research","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":"Third-party advisory: www.vulncheck.com"}],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}