CVE-2026-49410

Name of the Vulnerable Software and Affected Versions OpenHuman versions prior to 0.56.0

Description Cross-site request forgery is possible via the unauthenticated GET '/auth/telegram' loopback callback. The telegram auth handler function processes an attacker-supplied one-time Telegram login token and passes the resulting JWT to credentials::ops::store session without validating the request origin or browser fetch metadata. An attacker with an account can trick a user running the local core into visiting a malicious page that requests the '/auth/telegram' endpoint on loopback port 7788. This action switches the user's active local session to the attacker's backend account, allowing the attacker to access subsequent agent actions, memory writes, and Telegram messages associated with that session.

Recommendations Update to version 0.56.0.