---
id: "CVE-2026-49407"
kind: "vulnerability"
aliases: ["CVE-2026-49407"]
title: "OpenHuman: unauthenticated dictation WebSocket lets web pages exhaust resources"
severity: "high"
cvss: 7.7
epss: null
exploited: false
status: "open"
category: "ai-tooling"
products: []
ecosystems: []
tags: ["ai-agents", "ai-tooling", "desktop", "openhuman", "rust"]
not_affected_if: ["version-0.57.44-or-later"]
published_at: "2026-11-05T17:18:18+00:00"
first_seen_at: "2026-11-05T17:40:04+00:00"
updated_at: "2026-11-05T17:42:21+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-49407", "first_seen_at": "2026-11-05T17:40:04+00:00"}]
exploit_sources: []
---

# OpenHuman: unauthenticated dictation WebSocket lets web pages exhaust resources

OpenHuman, an open-source AI agent harness with a desktop app, exposes a local /ws/dictation WebSocket endpoint without client authentication or browser-origin checks. A malicious web page or any client reaching it can stream audio to trigger heavy speech-to-text work and unbounded buffering, crashing or slowing the app.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the installed OpenHuman desktop app or Rust library version against the fixed version below.
- Look for a local WebSocket endpoint at /ws/dictation in the running application.

## Fix

- OpenHuman: upgrade to `0.57.44` or later.

## Timeline

- 2026-11-05T17:40:04+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-49407

## Documents

- [advisory] Vendor advisory: github.com https://github.com/tinyhumansai/openhuman/security/advisories/GHSA-mfwq-rpj4-38xh
- [fix] Patch: github.com https://github.com/tinyhumansai/openhuman/commit/2944b83fc0da61edb3c461243593cdb64de74efe
- [fix] Patch: github.com https://github.com/tinyhumansai/openhuman/commit/cf5dd2d7c7897218e704c58268fc48decb63202c
- [fix] Release notes: github.com https://github.com/tinyhumansai/openhuman/releases/tag/v0.57.44

## From the sources

OpenHuman is an open-source agent harness available as a desktop application and Rust library. Before version 0.57.44, its local  /ws/dictation  WebSocket endpoint lacks client authentication and browser-origin validation. An unauthenticated client, including a malicious web page able to reach the endpoint, can submit audio and trigger resource-intensive speech-to-text processing. Earlier affected versions also accumulate audio in an unbounded buffer, allowing continuous streaming to exhaust process memory. These conditions can degrade performance, exhaust resources, or crash the application. This issue is fixed in version 0.57.44.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_