Threat database

OpenHuman versions before 0.56.0 are vulnerable to a cross-site request forgery (CSRF) attack on the unauthenticated GET /auth/telegram loopback callback. This flaw allows an attacker with an OpenHuman account to trick a user running the local core into switching their active session to the attacker's backend account, exposing sensitive agent actions, memory writes, and Telegram messages. The vulnerability is fixed in version 0.56.0.

The shell tool command allowlist in the SecurityPolicy of OpenHuman desktop agent through 0.54.0 (default Supervised security policy) can be bypassed to execute arbitrary OS commands with the privileges of the desktop user.