CVE-2026-49410 in OpenHuman
Summary
by MITRE • 10/17/2026
OpenHuman is an open-source agent harness available as a desktop application and Rust library. Versions before 0.56.0 allow cross-site request forgery against the unauthenticated GET /auth/telegram loopback callback because telegram_auth_handler consumes an attacker-supplied one-time Telegram login token and passes the returned JWT to credentials::ops::store_session without validating browser fetch metadata or the request origin. An attacker with an OpenHuman account can cause a user with the local core running to visit a malicious page that requests the /auth/telegram endpoint on loopback port 7788, switching the user's active local session to the attacker's backend account and exposing subsequent agent actions, memory writes, and Telegram messages associated with that session to the attacker. This issue is fixed in version 0.56.0.
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 10/17/2026
The vulnerability identified as a cross-site request forgery (CSRF) flaw within OpenHuman versions prior to 0.56.0 stems from insufficient validation of incoming authentication requests on the local loopback interface. OpenHuman, an open-source agent harness available both as a desktop application and a Rust library, implements a Telegram login flow that utilizes a GET /auth/telegram endpoint for handling OAuth-style callbacks. The core technical deficiency lies in the telegram_auth_handler function, which accepts an attacker-supplied one-time Telegram login token without verifying browser fetch metadata or checking the request origin header. This lack of validation allows any web page visited by a user with the local OpenHuman core running to trigger this authentication endpoint via a cross-origin HTTP GET request directed at loopback port 7788.
The operational impact of this vulnerability is severe, as it enables session hijacking and unauthorized access control bypasses. An attacker who possesses an OpenHuman account can craft a malicious webpage that automatically requests the /auth/telegram endpoint on the victim's local machine. When the victim visits this page while their browser has active cookies or authentication context for the loopback service, the application processes the forged request as if it were legitimate. Consequently, the system switches the user's active local session to associate with the attacker's backend account rather than the intended one. This effectively grants the attacker control over the agent's operational state on the victim's machine.
Once the session is compromised, the attacker gains visibility into sensitive data and actions performed by the agent under that session context. Specifically, this includes exposure of subsequent agent actions executed locally, memory writes generated during operation, and Telegram messages associated with the hijacked session. This represents a significant breach of confidentiality and integrity for users relying on OpenHuman to manage automated tasks or communications through their personal accounts. The vulnerability exploits the trust relationship between the local application and its loopback API, which is often assumed to be safe from external web pages due to network isolation, but fails when proper HTTP-level origin checks are omitted.
This issue aligns with CWE-352, Cross-Site Request Forgery (CSRF), specifically highlighting a failure in validating request origins for state-changing operations, even those occurring on local interfaces. In terms of the MITRE ATT&CK framework, this behavior corresponds to techniques involving account manipulation and potentially initial access through social engineering if combined with phishing vectors that lure users to malicious sites while their browser is active. The remediation strategy implemented in version 0.56.0 involves enforcing strict validation of request origins and fetch metadata within the telegram_auth_handler logic. Developers should ensure that all authentication endpoints, particularly those exposed on loopback interfaces for desktop applications, implement robust CSRF protections such as origin header verification or same-site cookie attributes to prevent unauthorized session switching from external web contexts.