CVE-2026-49410: OpenHuman /auth/telegram CSRF allows attacker-controlled session implantation
OpenHuman is an open-source agent harness available as a desktop application and Rust library. Versions before 0.56.0 allow cross-site request forgery against the unauthenticated GET /auth/telegram loopback callback because telegramauthhandler consumes an attacker-supplied one-time Telegram login token and passes the returned JWT to credentials::ops::storesession without validating browser fetch metadata or the request origin. An attacker with an OpenHuman account can cause a user with the local core running to visit a malicious page that requests the /auth/telegram endpoint on loopback port 7788, switching the user's active local session to the attacker's backend account and exposing subsequent agent actions, memory writes, and Telegram messages associated with that session to the attacker. This issue is fixed in version 0.56.0.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
OpenHumanto a version that resolves this vulnerability.Fixed in 0.56.0
Event History
Frequently Asked Questions
Who is exposed to this issue?
Users running the local OpenHuman core are exposed if they use a version before 0.56.0 and can be induced to visit a malicious page. The attacker must have an OpenHuman account.
Does exploitation require the victim to be logged in or provide credentials?
No. The vulnerable loopback callback is an unauthenticated GET endpoint, and exploitation requires only that the victim visit a page that sends a request to the local endpoint on port 7788.
What is the impact of a successful attack?
The attack replaces the victim's active local session with the attacker's backend account. Subsequent agent actions, memory writes, and Telegram messages associated with that session may be exposed to the attacker.
What version fixes the issue?
Upgrade OpenHuman to version 0.56.0 or later. Versions before 0.56.0 are affected.