CVE-2026-49407

Name of the Vulnerable Software and Affected Versions OpenHuman versions prior to 0.57.44

Description The local '/ws/dictation' WebSocket endpoint lacks client authentication and browser-origin validation. This allows an unauthenticated client, such as a malicious web page, to submit audio and trigger resource-intensive speech-to-text processing. In earlier versions, audio is accumulated in an unbounded buffer, which can lead to process memory exhaustion through continuous streaming. These factors can result in performance degradation, resource exhaustion, or application crashes.

Recommendations Update to version 0.57.44.