CVE-2026-49410: CWE-352: Cross-Site Request Forgery (CSRF) in tinyhumansai openhuman

OpenHuman, an open-source agent harness available as a desktop application and Rust library, has a CSRF vulnerability (CWE-352) in versions prior to 0.56.0. The vulnerability exists because the telegram_auth_handler consumes an attacker-supplied one-time Telegram login token and passes the returned JWT to credentials::ops::store_session without validating browser fetch metadata or the request origin. This allows an attacker with an OpenHuman account to cause a user running the local core to visit a malicious page that requests the /auth/telegram endpoint on loopback port 7788, switching the user's active local session to the attacker's backend account and exposing sensitive session data.

Successful exploitation allows an attacker to hijack a user's local session by switching it to the attacker's backend account. This leads to exposure of agent actions, memory writes, and Telegram messages associated with that session, resulting in confidentiality and integrity loss. The CVSS 3.1 score is 8.1 (High), reflecting network attack vector, low attack complexity, no privileges required, user interaction required, unchanged scope, and high confidentiality and integrity impacts.

This vulnerability is fixed in OpenHuman version 0.56.0. Users and administrators should upgrade to version 0.56.0 or later to remediate this issue. No other mitigation is indicated by the vendor advisory.