---
id: "CVE-2026-49410"
kind: "vulnerability"
aliases: ["CVE-2026-49410"]
title: "OpenHuman: cross-site request forgery switches local agent session to attacker account"
severity: "high"
cvss: 8.1
epss: null
exploited: false
status: "open"
category: "ai-tooling"
products: []
ecosystems: []
tags: ["ai-agents", "ai-tooling", "desktop", "openhuman", "rust", "telegram"]
not_affected_if: ["already-on-0.56.0"]
published_at: "2026-10-16T22:17:23+00:00"
first_seen_at: "2026-10-23T21:57:14+00:00"
updated_at: "2026-10-25T03:06:45+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-49410", "first_seen_at": "2026-10-23T21:57:14+00:00"}]
---

# OpenHuman: cross-site request forgery switches local agent session to attacker account

OpenHuman versions before 0.56.0 expose an unauthenticated loopback callback at GET /auth/telegram on port 7788 that accepts an attacker-supplied login token without checking the request origin. A malicious web page can make a user's browser call it, switching the user's active local session to the attacker's account so later agent actions, memory writes and Telegram messages are exposed to the attacker.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the installed OpenHuman version is below `0.56.0`
- Confirm whether the local core is running and listening on loopback port `7788`

## Fix

- Upgrade OpenHuman to `0.56.0` or later

## Timeline

- 2026-10-23T21:57:14+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-49410

## From the sources

OpenHuman is an open-source agent harness available as a desktop application and Rust library. Versions before 0.56.0 allow cross-site request forgery against the unauthenticated GET /auth/telegram loopback callback because telegram_auth_handler consumes an attacker-supplied one-time Telegram login token and passes the returned JWT to credentials::ops::store_session without validating browser fetch metadata or the request origin. An attacker with an OpenHuman account can cause a user with the local core running to visit a malicious page that requests the /auth/telegram endpoint on loopback port 7788, switching the user's active local session to the attacker's backend account and exposing subsequent agent actions, memory writes, and Telegram messages associated with that session to the attacker. This issue is fixed in version 0.56.0.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_