---
id: "CVE-2026-123094"
kind: "vulnerability"
aliases: ["CVE-2026-123094"]
title: "Huginn: stored XSS in OAuth service labels runs script in victims' browsers"
severity: "medium"
cvss: 5.4
epss: null
exploited: false
status: "open"
category: "runtime"
products: []
ecosystems: []
tags: ["huginn", "oauth", "runtime", "self-hosted"]
not_affected_if: ["no-oauth-connections", "version-2026.11.05-or-later"]
published_at: "2026-11-05T16:17:46+00:00"
first_seen_at: "2026-11-05T16:40:02+00:00"
updated_at: "2026-11-05T16:41:45+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-123094", "first_seen_at": "2026-11-05T16:40:02+00:00"}]
exploit_sources: []
---

# Huginn: stored XSS in OAuth service labels runs script in victims' browsers

Huginn marks OAuth service display names as safe HTML without escaping them, so a crafted nickname, name or email from a connected OAuth account is stored and rendered as script. An attacker who can log in can run JavaScript in the browser of a user who attaches that account to an agent, including an administrator, exposing credentials, agents and events.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the Huginn version: `huginn` release before `2026.11.05` is affected.
- Look for shared OAuth service connections whose display name or email contains HTML or script tags.

## Fix

- Huginn: move to `2026.11.05` or later.

## Timeline

- 2026-11-05T16:40:02+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-123094

## Documents

- [advisory] Vendor advisory: github.com https://github.com/huginn/huginn/security/advisories/GHSA-rjw9-xx87-f2ww
- [advisory] Third-party advisory: www.vulncheck.com https://www.vulncheck.com/advisories/huginn-before-2026.11.05-stored-xss-via-oauth-service-display-name
- [fix] Patch: github.com https://github.com/huginn/huginn/commit/92229a5e7343bfffc740d31e42b9654b212b678b
- [fix] Release notes: github.com https://github.com/huginn/huginn/releases/tag/v2026.11.05

## From the sources

Huginn before 2026.11.05 contains a stored cross-site scripting vulnerability in the service_label helper that marks unescaped OAuth service display names as html_safe. Authenticated attackers can connect an OAuth account with a crafted nickname, name or email and share it globally, executing JavaScript when victims attach it to Agents and view them, exposing Credentials, Agents and Events, and admin actions if the victim is an administrator.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_