OpenHuman Agent Vulnerability in WebSocket Client Authentication

CVE-2026-49407

What is CVE-2026-49407?

The OpenHuman agent, available as a desktop application and Rust library, features a critical vulnerability in its local /ws/dictation WebSocket endpoint prior to version 0.57.44. This flaw allows unauthenticated clients to interact with the endpoint, enabling malicious web pages to submit audio data, which may trigger extensive speech-to-text processing. Moreover, earlier versions accumulate audio in an unbounded buffer, posing a risk of resource exhaustion and potential application crashes. Users are encouraged to upgrade to version 0.57.44 or later to mitigate these security concerns. For further details, please refer to the official GitHub advisory.

References