Token Exposure Vulnerability in OpenHuman Desktop Application by Tiny Humans

CVE-2026-54146

What is CVE-2026-54146?

The OpenHuman desktop application, developed by Tiny Humans, contains a vulnerability that exposes the OPENHUMAN_CORE_TOKEN bearer credential in the environment. The core process publishes this sensitive token even when it operates as an in-process task. This design flaw allows other processes running under the same user to access the environment variable via the macOS KERN_PROCARGS2 interface, enabling potential attackers to authenticate to the core JSON-RPC service. As a result, they could exploit agent memory, access integrated account data, perform privileged actions, alter configurations, and disrupt services without requiring root access or any modification to System Integrity Protection. This issue impacts both Intel and Apple Silicon macOS systems and has been addressed in version 0.57.5.

References