Stored Cross-Site Scripting in Huginn OAuth Service Display Names
CVE-2026-123094

5.1MEDIUM

Key Information:

Vendor

Huginn

Status
Huginn
Vendor
CVE Published:
5 November 2026

What is CVE-2026-123094?

Huginn versions prior to 2026.11.05 are susceptible to a stored cross-site scripting vulnerability due to a flaw in the service_label helper. The vulnerability allows authenticated attackers to exploit unescaped OAuth service display names. By crafting malicious nicknames, names, or emails, an attacker can associate their OAuth account with a victim's Huginn setup. When victims connect and view these maliciously crafted accounts through Agents, the embedded JavaScript can execute, leading to exposure of credentials, Agents, Events, and potential admin actions for those with elevated privileges.

Affected Version(s)

huginn 0 < 2026.11.05

References

https://github.com/huginn/huginn/security/advisories/GHSA...
vendor-advisory
https://github.com/huginn/huginn/commit/92229a5e7343bfffc...
patch
https://github.com/huginn/huginn/blob/v2026.11.01/app/hel...
technical-description

CVSS V4

Score:
5.1
Severity:
MEDIUM
Confidentiality:
None
Integrity:
None
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
Unknown

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

leediay153 from Viettel Post
Akinori Musha
.