CVE-2026-49407 in OpenHuman
Summary
by MITRE • 11/05/2026
OpenHuman is an open-source agent harness available as a desktop application and Rust library. Before version 0.57.44, its local /ws/dictation WebSocket endpoint lacks client authentication and browser-origin validation. An unauthenticated client, including a malicious web page able to reach the endpoint, can submit audio and trigger resource-intensive speech-to-text processing. Earlier affected versions also accumulate audio in an unbounded buffer, allowing continuous streaming to exhaust process memory. These conditions can degrade performance, exhaust resources, or crash the application. This issue is fixed in version 0.57.44.
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.
Analysis
by VulDB Data Team • 11/05/2026
The vulnerability identified within OpenHuman prior to version 0.57.44 represents a critical failure in access control and resource management mechanisms for its local WebSocket endpoint located at /ws/dictation. As an open-source agent harness available as both a desktop application and a Rust library, OpenHuman processes audio input through speech-to-text functionality. The core technical flaw lies in the absence of client authentication and browser-origin validation on this specific endpoint. This design oversight allows any unauthenticated entity to interact with the service directly. In practical terms, this means that a malicious web page hosted by an attacker can establish a connection to the local WebSocket server if it is able to reach the network interface where OpenHuman is listening. The lack of origin checks further exacerbates this risk by permitting cross-origin requests from arbitrary sources without verifying their legitimacy or trustworthiness.
The operational impact of these deficiencies is severe, primarily manifesting as resource exhaustion and potential denial of service conditions. An unauthenticated client can submit audio data to trigger the speech-to-text processing pipeline repeatedly. Because earlier affected versions also accumulate audio in an unbounded buffer, there are no limits placed on the amount of data that can be queued for processing at any given time. This allows a malicious actor to engage in continuous streaming attacks where they flood the endpoint with audio streams indefinitely. The application is forced to allocate memory continuously to store these incoming buffers and process them through computationally intensive speech recognition algorithms. Consequently, this leads to rapid depletion of available system resources, including RAM and CPU cycles.
The degradation of performance caused by such an attack can range from noticeable sluggishness in the host operating environment to complete unresponsiveness of the OpenHuman application itself. In extreme cases, the memory exhaustion may cause the process to crash or be terminated by the operating system's out-of-memory killer mechanism. This not only disrupts legitimate user activities but also undermines the reliability and stability of any systems relying on this agent harness for automated tasks. The vulnerability aligns with CWE-284 Improper Access Control, as it fails to restrict access to a resource based on identity or trust level, and CWE-770 Allocation of Resources Without Limits or Throttling, due to the unbounded buffer accumulation that enables denial-of-service conditions. From an ATT&CK perspective, this scenario reflects techniques associated with Resource Hijacking and Denial of Service, where adversaries leverage misconfigured services to consume computational resources for disruptive purposes.
To mitigate these risks, users must upgrade immediately to version 0.57.44 or later, which addresses the authentication gaps and implements proper resource limits. For developers integrating OpenHuman into their own applications, it is imperative to ensure that network configurations restrict access to local WebSocket endpoints only from trusted sources. Implementing strict origin validation headers on server-side handlers can prevent unauthorized web pages from interacting with the service. Additionally, enforcing rate limiting and maximum buffer sizes for incoming audio streams will protect against memory exhaustion attacks even if authentication mechanisms are bypassed or not fully implemented in custom deployments. Regular security audits of WebSocket implementations should include checks for missing access controls and unbounded resource consumption patterns to maintain robust application integrity.