CVE-2026-49405Medium· 6.2▾ TwilightPoC availableOpenHuman is an open-source agent harness available as a desktop application and Rust library. Before 0.56.0, the local server exposes the server-sent events endpoint at /events without bearer authentication, permits cross-origin browser…
▾ Twilight zone — High severity, or a signal on a lesser flaw
impact 34.1 · likelihood 0 · exploitation 12
A public proof-of-concept already exists for this vulnerability — see Exploit availability below.
Stakeholder-Specific Vulnerability Categorization from CISA's ADP record at CVE.org: whether exploitation is observed, whether an attack can be automated, and how much of the system is at stake. The CVSS score shown above comes from the assigning CNA record, not NVD.
OpenHuman is an open-source agent harness available as a desktop application and Rust library. Before 0.56.0, the local server exposes the server-sent events endpoint at /events without bearer authentication, permits cross-origin browser access, and uses only a caller-supplied client_id to select WebChannelEvent objects from the process-wide event bus. An unauthenticated local client, or an attacker-hosted web page opened by the victim, can subscribe to another client's stream by supplying a known or guessed identifier; the fixed system identifier makes the proactive-message stream predictable. The exposed events can include complete assistant responses, streamed message content, tool names, tool arguments, and raw tool outputs intended for the local user interface. This issue is fixed in version 0.56.0.
openhuman < 0.56.0Refer to the linked advisories for vendor-supplied fixes and affected version ranges.
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-49393High· 8.4OpenHuman: Unauthenticated Socket.IO RPC bypass allows invoking protected OpenHuman core controllers without the Bearer token
CVE-2026-49410High· 8.1OpenHuman /auth/telegram CSRF allows attacker-controlled session implantation
CVE-2026-54144Medium· 6.1OpenHuman: Embedded Google Meet webview can silently capture the macOS desktop without a user gesture
CVE-2026-49407High· 7.7OpenHuman: Unauthenticated dictation WebSocket allows arbitrary audio streaming and unbounded memory growth
CVE-2026-54145High· 8.8OpenHuman: Bearer token leaked via approval gate session_id (SQLite plaintext + debug log + RPC response)
CVE-2026-54142High· 8.7OpenHuman: Indirect prompt injection via background email sync executes Composio actions without user approval