OpenHuman Desktop Application Exposes Sensitive Tokens via JSON-RPC
CVE-2026-54145
8.8HIGH
What is CVE-2026-54145?
OpenHuman, an open-source agent framework, faced a vulnerability in versions prior to 0.57.5 where the JSON-RPC bearer token was improperly used as an approval session identifier. This flaw resulted in the potential exposure of sensitive credentials through persisted approval records, debug logs, and RPC responses. If an attacker gains access to these artifacts, they can retrieve the bearer token and exploit the core RPC interface while the token remains valid. This allows unauthorized access to sensitive data and enables the execution of privileged operations. Users are encouraged to upgrade to version 0.57.5, which addresses this vulnerability.
Affected Version(s)
openhuman < 0.57.5