CVE-2026-123094: Huginn before 2026.11.05 Stored XSS via OAuth Service Display Name
Huginn before 2026.11.05 contains a stored cross-site scripting vulnerability in the servicelabel helper that marks unescaped OAuth service display names as htmlsafe. Authenticated attackers can connect an OAuth account with a crafted nickname, name or email and share it globally, executing JavaScript when victims attach it to Agents and view them, exposing Credentials, Agents and Events, and admin actions if the victim is an administrator.
Event History
Frequently Asked Questions
Who can exploit this issue, and what must they do?
An authenticated Huginn user must connect an OAuth account whose nickname, name, or email contains crafted script content. They must then share that OAuth connection globally so another user can attach it to an Agent and view it.
Who is exposed to the malicious script?
Users who attach the globally shared OAuth connection to an Agent and view that Agent are exposed. If the viewing user is an administrator, the script can perform administrator actions in that user's context.
What can be done while a patch is not immediately available?
Avoid globally sharing OAuth connections from untrusted users, and do not attach or view Agents using globally shared OAuth connections with untrusted display names. Review existing globally shared OAuth connections for suspicious nickname, name, or email values.
How can I determine whether an installation is affected?
Huginn versions before 2026.11.05 are affected. The relevant behavior is in the service_label helper, which renders OAuth service display names as safe HTML without escaping them.