CVE-2026-123094

Name of the Vulnerable Software and Affected Versions Huginn versions prior to 2026.11.05

Description A stored cross-site scripting issue exists in the service label helper, which incorrectly marks unescaped OAuth service display names as html safe. Authenticated attackers can connect an OAuth account using a crafted nickname, name, or email and share it globally. This allows the execution of JavaScript when victims attach the account to Agents and view them. Potential impacts include the exposure of Credentials, Agents, and Events, as well as the execution of admin actions if the victim has administrator privileges.

Recommendations Update Huginn to version 2026.11.05 or later.