Cross-Site Request Forgery in OpenHuman Desktop Application and Rust Library

CVE-2026-49410

What is CVE-2026-49410?

The OpenHuman application is vulnerable to cross-site request forgery (CSRF) attacks prior to version 0.56.0. An attacker can exploit this vulnerability by tricking a user with a valid OpenHuman account into visiting a malicious webpage, which then initiates an unauthenticated request to the /auth/telegram endpoint running on the local core. This request leverages a one-time Telegram login token and manipulates the authorization process, allowing the attacker to take control of the user's session. Once compromised, the attacker gains access to sensitive information, including ongoing actions, memory writes, and Telegram messages associated with the user's active local session. It is crucial for users to upgrade to version 0.56.0 or later to mitigate this risk.

References