TI-2026-75524 Aliases CVE-2026-49410

OpenHuman Telegram login callback lets attackers swap user sessions

HIGH 70CWE-352Published 2026-10-16 · Updated 2026-10-19

Key facts

Attack vector: Network
Privileges required: None
User interaction: Required
Attack complexity: Low
Impact type: Tampering, Spoofing
Confidentiality · integrity · availability: High · High · None
Fix status: Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-352 and CWE-384.

Summary

OpenHuman versions before 0.56.0 allow cross-site request forgery against the unauthenticated /auth/telegram loopback callback, which stores an attacker-supplied session without checking the request origin (CWE-352). An attacker with an OpenHuman account can lure a user running the local core to a malicious page that switches the user's active session to the attacker's account. Subsequent agent actions, memory writes and Telegram messages in that session then become visible to the attacker.

Written with Claude Haiku 5.5 from the sources below · 2026-10-28

Description from the CNA

OpenHuman is an open-source agent harness available as a desktop application and Rust library. Versions before 0.56.0 allow cross-site request forgery against the unauthenticated GET /auth/telegram loopback callback because telegram_auth_handler consumes an attacker-supplied one-time Telegram login token and passes the returned JWT to credentials::ops::store_session without validating browser fetch metadata or the request origin. An attacker with an OpenHuman account can cause a user with the local core running to visit a malicious page that requests the /auth/telegram endpoint on loopback port 7788, switching the user's active local session to the attacker's backend account and exposing subsequent agent actions, memory writes, and Telegram messages associated with that session to the attacker. This issue is fixed in version 0.56.0.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV

EPSS 0.00191 8th percentileScored 2026-11-07

Fix Fixed openhuman (tinyhumansai): 0.56.0

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: Poc
Automatable: No
Technical impact: Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
tinyhumansai	openhuman	before 0.56.0	0.56.0	Patch available	CNA

openhuman Vendortinyhumansai Affected before 0.56.0 Fixed in 0.56.0 Patch available CNA

Remediation

Upgrade OpenHuman to version 0.56.0, which fixes this issue.

Written with Claude Haiku 5.5 from the sources below · 2026-10-28

Fix · CNA openhuman (tinyhumansai) Fixed in 0.56.0

Timeline

2026-10-18 Threatist record created from CVE-2026-49410
2026-10-18 Priority changed: MEDIUM → LOW
2026-10-19 CISA SSVC decision points changed
2026-10-20 Priority changed: LOW → HIGH

References

Other 4

TI-2026-85521 Prompt injection in OpenHuman background sync runs Composio actions CVSS 3.1HIGH 8.7
TI-2026-85515 OpenHuman event stream endpoint leaks user-facing data without authentication CVSS 3.1MEDIUM 6.2
TI-2026-85522 OpenHuman lets channel messages create unapproved shell cron jobs CVSS 3.1CRITICAL 9.8
TI-2026-40241 OpenHuman desktop agent shell tool sandbox bypass leads to arbitrary command execution CVSS 4.0CRITICAL 9.4
TI-2026-85516 OpenHuman Yuanbao channel bypasses approval for node_exec commands CVSS 3.1CRITICAL 9.0
TI-2026-85523 OpenHuman bearer token leak via process environment variable on macOS CVSS 3.1HIGH 8.8

See all 11 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences