OpenHuman: Cross-site request forgery in Telegram login callback
Summary
OpenHuman, an open-source agent harness available as a desktop application and Rust library, has a cross-site request forgery flaw in its local /auth/telegram callback on loopback port 7788. The handler accepts a one-time Telegram login token and stores the returned session without checking browser fetch metadata or the request origin. A malicious web page visited by a user with the local core running can switch that user's active session to the attacker's account, so later agent actions, memory writes and Telegram messages go to the attacker. The attacker needs their own OpenHuman account.
Affected
- OpenHuman versions before 0.56.0
Fixed in
- Upgrade to OpenHuman 0.56.0 or later. The fix is in pull request #2331.
Workaround
Unknown. No vendor workaround for affected builds is confirmed.
- Analyst suggestion, not from vendor sources: stop the local core while browsing untrusted websites until the upgrade is complete.
Exploitation
- CISA SSVC lists exploitation as 'poc' (proof of concept), automatable as 'no' and technical impact as 'total'.
- No confirmed exploitation in the wild is known. The issue is not in CISA KEV.
- A third-party write-up dated 2026-10-09 exists. Its contents were not verified.
Our recommendation
- Inventory workstations that run OpenHuman.
- Upgrade to 0.56.0 or later, ideally the latest release.
- Until the upgrade is done, stop the local core while browsing untrusted websites.
- Review active sessions and Telegram activity for unexpected account changes.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- GitHub Security Advisory GHSA-c4m9-hw7m-vv3m github.com
- OpenHuman release v0.56.0 github.com
- OpenHuman fix pull request #2331 github.com
- OpenHuman fix commit b1bbc53 github.com
- VulDB CVE-2026-49410 vuldb.com
- VulDB vulnerability 421517 vuldb.com
- Vulners CVE-2026-49410 (CVELIST) vulners.com
- Strix CVE-2026-49410 www.strix.ai
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 1 Nov 2026, 18:51.
Original description (NVD)
OpenHuman is an open-source agent harness available as a desktop application and Rust library. Versions before 0.56.0 allow cross-site request forgery against the unauthenticated GET /auth/telegram loopback callback because telegram_auth_handler consumes an attacker-supplied one-time Telegram login token and passes the returned JWT to credentials::ops::store_session without validating browser fetch metadata or the request origin. An attacker with an OpenHuman account can cause a user with the local core running to visit a malicious page that requests the /auth/telegram endpoint on loopback port 7788, switching the user's active local session to the attacker's backend account and exposing subsequent agent actions, memory writes, and Telegram messages associated with that session to the attacker. This issue is fixed in version 0.56.0.
NVD references (5)
- https://github.com/tinyhumansai/openhuman/commit/b1bbc53fceed7d1f0cff90cbb0a42f4ab8e153a1
- https://github.com/tinyhumansai/openhuman/pull/2331
- https://github.com/tinyhumansai/openhuman/releases/tag/v0.56.0
- https://github.com/tinyhumansai/openhuman/security/advisories/GHSA-c4m9-hw7m-vv3m
- https://github.com/tinyhumansai/openhuman/security/advisories/GHSA-c4m9-hw7m-vv3m
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.