{"id":"CVE-2026-49410","kind":"vulnerability","aliases":["CVE-2026-49410"],"related":[],"title":"OpenHuman: cross-site request forgery switches local agent session to attacker account","description":"OpenHuman is an open-source agent harness available as a desktop application and Rust library. Versions before 0.56.0 allow cross-site request forgery against the unauthenticated GET /auth/telegram loopback callback because telegram_auth_handler consumes an attacker-supplied one-time Telegram login token and passes the returned JWT to credentials::ops::store_session without validating browser fetch metadata or the request origin. An attacker with an OpenHuman account can cause a user with the local core running to visit a malicious page that requests the /auth/telegram endpoint on loopback port 7788, switching the user's active local session to the attacker's backend account and exposing subsequent agent actions, memory writes, and Telegram messages associated with that session to the attacker. This issue is fixed in version 0.56.0.","summary":"OpenHuman versions before 0.56.0 expose an unauthenticated loopback callback at GET /auth/telegram on port 7788 that accepts an attacker-supplied login token without checking the request origin. A malicious web page can make a user's browser call it, switching the user's active local session to the attacker's account so later agent actions, memory writes and Telegram messages are exposed to the attacker.","severity":"high","cvss":8.1,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["ai-agents","ai-tooling","desktop","openhuman","rust","telegram"],"not_affected_if":["already-on-0.56.0"],"how_to_check":"- Check the installed OpenHuman version is below `0.56.0`\n- Confirm whether the local core is running and listening on loopback port `7788`","fix":"- Upgrade OpenHuman to `0.56.0` or later","status":"open","published_at":"2026-10-16T22:17:23+00:00","first_seen_at":"2026-10-23T21:57:14+00:00","triaged_at":"2026-10-25T03:06:45+00:00","updated_at":"2026-10-25T03:06:45+00:00","category":"ai-tooling","confidence":0.8,"triage":{"at":"2026-10-25T03:06:45Z","model":"claude-haiku-5-5","output":{"fix":"- Upgrade OpenHuman to `0.56.0` or later","reach":"internet","title":"OpenHuman: cross-site request forgery switches local agent session to attacker account","impact":"medium","summary":"OpenHuman versions before 0.56.0 expose an unauthenticated loopback callback at GET /auth/telegram on port 7788 that accepts an attacker-supplied login token without checking the request origin. A malicious web page can make a user's browser call it, switching the user's active local session to the attacker's account so later agent actions, memory writes and Telegram messages are exposed to the attacker.","category":"ai-tooling","nicknames":[],"who_cares":["openhuman","desktop","rust","ai-agents","telegram"],"confidence":0.8,"needs_auth":"yes","worst_case":"attacker takes over local session, reads agent actions and Telegram messages","analyst_note":"","how_to_check":"- Check the installed OpenHuman version is below `0.56.0`\n- Confirm whether the local core is running and listening on loopback port `7788`","needs_analyst":false,"not_affected_if":["already-on-0.56.0"],"who_is_affected":"Users who run the OpenHuman desktop application or Rust library with the local core running on a version before `0.56.0`. The attack needs the victim to visit a malicious page while the local core is running, and the attacker needs their own OpenHuman account. Systems on `0.56.0` or later are fixed.","user_interaction":"yes","needs_special_setup":"no","severity_if_unknown":"unknown"},"cost_usd":0.000984,"input_tokens":3468,"output_tokens":1274,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-2026':15A,18A '-49410':16A,19A '/auth/telegram':41B,125C,185C '0.56.0':33B,114C,227C '7788':44B,190C 'accept':46B 'account':13A,81B,167C,203C 'action':85B,208C 'activ':74B,195C 'agent':9A,22B,84B,102C,207C 'ai':21B,24B 'ai-ag':20B 'ai-tool':23B 'allow':115C 'applic':108C 'associ':214C 'attack':12A,49B,79B,95B,135C,163C,200C,220C 'attacker-suppli':48B,134C 'auth':130C 'avail':104C 'backend':202C 'browser':67B,155C 'call':68B 'callback':38B,127C 'caus':169C 'check':54B 'consum':132C 'core':175C 'credenti':149C 'cross':3A,117C 'cross-sit':2A,116C 'cve':14A,17A 'desktop':26B,107C 'endpoint':186C 'expos':34B,92B,205C 'fetch':156C 'fix':224C 'forgeri':6A,120C 'get':40B,124C 'handler':131C 'har':103C 'issu':222C 'jwt':147C 'later':83B 'librari':111C 'local':8A,75B,174C,196C 'login':51B,141C 'loopback':37B,126C,188C 'make':63B 'malici':59B,180C 'memori':86B,209C 'messag':90B,213C 'metadata':157C 'one':138C 'one-tim':137C 'op':150C 'open':100C 'open-sourc':99C 'openhuman':1A,27B,30B,96C,166C 'origin':57B,161C 'page':61B,181C 'pass':144C 'port':43B,189C 'request':5A,56B,119C,160C,183C 'return':146C 'run':176C 'rust':28B,110C 'session':10A,76B,152C,197C,217C 'site':4A,118C 'sourc':101C 'store':151C 'subsequ':206C 'suppli':50B,136C 'switch':7A,70B,191C 'telegram':29B,89B,129C,140C,212C 'time':139C 'token':52B,142C 'tool':25B 'unauthent':36B,123C 'user':65B,72B,171C,193C 'valid':154C 'version':31B,112C,226C 'visit':178C 'web':60B 'without':53B,153C 'write':87B,210C","nicknames":[],"mitigations":[],"who_affected":"Users who run the OpenHuman desktop application or Rust library with the local core running on a version before `0.56.0`. The attack needs the victim to visit a malicious page while the local core is running, and the attacker needs their own OpenHuman account. Systems on `0.56.0` or later are fixed.","tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-16T22:17:23+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N","cvss_by":"security-advisories@github.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-49410","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-49410","severity":null,"published_at":"2026-10-16T22:17:23+00:00","modified_at":"2026-10-19T22:17:10+00:00","first_seen_at":"2026-10-23T21:57:14+00:00","fetched_at":"2026-10-23T22:28:55+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}