Authentication Bypass in OpenHuman Desktop Application by Tiny Humans AI

CVE-2026-49393

What is CVE-2026-49393?

The OpenHuman application, a versatile tool developed by Tiny Humans AI, suffered from an authentication bypass vulnerability. Prior to version 0.56.0, it failed to implement proper authentication for Socket.IO handlers, allowing local unauthenticated clients to issue requests and gain access to sensitive operations. This could enable attackers to read configuration and health data, initiate processes, interact with account APIs, modify local data, or control services. This vulnerability poses significant security risks, as unauthorized users could manipulate the application environment without proper verification.

References