Key points
- CVE-2026-49410 affects OpenHuman versions prior to 0.56.0.
- The flaw allows unauthenticated CSRF attacks on the Telegram login callback.
- Attackers can switch active sessions to their own backend accounts.
OpenHuman releases version 0.56.0 to address a high-severity cross-site request forgery vulnerability identified as CVE-2026-49410. The issue impacts all versions of the open-source agent harness prior to this release, affecting both the desktop application and the Rust library components.
What happened
The vulnerability exists within the unauthenticated GET /auth/telegram loopback callback endpoint. According to the National Vulnerability Database record, the telegram_auth_handler component processes attacker-supplied one-time Telegram login tokens. This handler passes the resulting JSON Web Token to the credentials::ops::store_session function without validating browser fetch metadata or request origin.
An attacker who possesses an OpenHuman account can exploit this lack of origin validation. They can induce a user with the local core running to visit a malicious web page. This page requests the /auth/telegram endpoint on the local loopback port 7788. Consequently, the user's active local session is switched to the attacker's backend account.
Why it matters
This session hijacking exposes subsequent agent actions and memory writes to the attacker. Telegram messages associated with the compromised session are also revealed. The flaw is rated CVSS 8.1 HIGH by the NVD. It is categorised under weaknesses CWE-352 and CWE-384. The issue allows an attacker to take control of the local core's interaction with the backend. This effectively grants the attacker visibility into the user's agent operations. The risk is significant for any environment where the local core is active and accessible. Users relying on the Telegram authentication flow are directly exposed to this attack vector.
What happens next
- Upgrade OpenHuman to version 0.56.0 immediately to resolve the vulnerability.
- Audit active sessions for any unauthorised backend account associations.
- Monitor logs for unusual requests to the /auth/telegram endpoint.
- Verify that loopback port 7788 is not exposed to external networks.
Patch priority
Teams should prioritise updating systems where the OpenHuman local core is actively running. Exposure to the internet increases the risk of malicious page delivery. Verify that the upgrade successfully applies to both desktop and library installations. Test the updated version in a controlled environment before wide deployment. Back up current configuration files to ensure recovery if issues arise. If immediate patching is not feasible, restrict network access to the loopback port. Monitor for suspicious Telegram authentication requests as a temporary measure.
Background: Session hijacking
Session hijacking occurs when an attacker steals the unique identifier your web browser uses to keep you logged in. This bypasses password requirements entirely. You can reduce risk by using secure connections, avoiding public networks, and enabling account recovery methods that verify your identity.
Read the full guide: Session Hijacking Explained: How Attackers Steal Your Digital Key
What to do and how to stay safe: OpenHuman
- Confirm your current OpenHuman version is 0.56.0 or later.
- Review access logs for unexpected Telegram authentication callbacks.
- Ensure loopback services are not accessible from untrusted networks.
- Educate users about the risks of visiting untrusted web pages.
Step-by-step guide: Patch Management: Definition, Purpose and Operational Reality
General security guidance from the AppSec Scoop newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
What is the CVSS score for CVE-2026-49410?
The National Vulnerability Database rates the vulnerability as CVSS 8.1 HIGH.
Which versions of OpenHuman are affected by this flaw?
All versions of OpenHuman prior to 0.56.0 are affected by this issue.
Is there a fix available for this vulnerability?
Yes, the issue is fixed in version 0.56.0 of the OpenHuman agent harness.
