Authentication Bypass in OpenHuman Desktop Application by Tiny Humans AI

CVE-2026-49405

What is CVE-2026-49405?

The OpenHuman application, developed by Tiny Humans AI, is vulnerable due to its local server exposing the server-sent events endpoint at /events without proper bearer authentication. This flaw allows unauthorized access, enabling both local clients and attacker-hosted web pages to subscribe to another user's event stream by leveraging predictable identifiers. Critical information, including messages and responses, may thus be accessed by unauthorized entities. The issue has been addressed in version 0.56.0, which mitigates this risk.

References