CVE-2026-49410

Executive Summary

CVE-2026-49410 is a cross-site request forgery (CSRF) vulnerability in OpenHuman, an open-source agent harness distributed as both a desktop application and a Rust library. Versions before 0.56.0 expose an unauthenticated loopback callback endpoint (GET /auth/telegram on port 7788) that consumes an attacker-supplied Telegram login token and stores the resulting JWT session without validating browser fetch metadata or request origin. An attacker with an OpenHuman account can silently switch a victim's active local session to the attacker's backend account, exposing the victim's subsequent agent actions, memory writes, and Telegram messages. The vulnerability carries a CVSS score of 8.1 (High) and is fixed in version 0.56.0.

Technical Analysis

OpenHuman operates a local "core" service that listens on the loopback interface at port 7788 and handles the Telegram authentication flow. The vulnerable handler, telegram_auth_handler, is reachable via GET /auth/telegram and is explicitly unauthenticated — it does not require a pre-existing session or local secret to be invoked. When called with a valid one-time Telegram login token in the request, the handler completes the Telegram auth exchange and passes the returned JWT into credentials::ops::store_session, which persists it as the active session for the local application.

The core flaw is CWE-352 (Cross-Site Request Forgery): the handler does not validate browser fetch metadata (Sec-Fetch-Site/Sec-Fetch-Mode) nor the request Origin, so a request originating from any web page in the user's browser is treated identically to a legitimate local action. Because the attacker supplies the one-time login token, the handler returns the attacker's JWT and the local client stores it as the victim's active session — an account-swap primitive rather than a simple request forgery.

Attack surface properties:

• Reachability: the endpoint binds to loopback (port 7788). Loopback is not exposed to the network, but it is reachable from the user's browser, which is the classic CSRF-against-localhost vector. The AV:N metric reflects that the malicious page is served remotely even though the callback is local.
• Authentication: none required at the endpoint. The token is attacker-chosen, so the exchanged identity is under the attacker's control.
• State change: the handler writes session state (store_session). CSRF succeeds because state-changing behavior is permitted on a GET with no origin/CSRF checks and no anti-forgery token.

No public exploit code, PoC, or Nuclei template is available. The following mechanics are therefore inferred strictly from the vulnerability class (CSRF against an unauthenticated localhost OAuth-style callback) and the NVD description, which explicitly names the endpoint, handler, and session-storage path.

Exploitation Scenarios

1. Reconnaissance / target identification. The attacker needs (a) an OpenHuman account of their own and (b) a victim running the OpenHuman desktop app with its local core active on port 7788. Discovery of the victim is social: the attacker simply needs the target to open a web page while the app is running. The attacker obtains their own one-time Telegram login token by initiating the normal Telegram login flow against their account.

2. Trigger. The attacker hosts (or embeds) a malicious web page containing a request to http://127.0.0.1:7788/auth/telegram carrying the attacker's one-time token. Because the handler is unauthenticated and does not check origin or fetch metadata, the victim's browser is free to issue this cross-origin GET. The browser transmits it to the victim's own loopback core — the attacker's remote page never receives a response, but the side effect occurs on the local service.

3. Execution (vulnerability-class level). On receipt, telegram_auth_handler consumes the attacker's token, performs the Telegram exchange, and calls credentials::ops::store_session with the resulting JWT. The victim's application now has the attacker's backend account as the active session. No credentials are phished; the CSRF is a pure state change driven by the attacker-controlled token.

4. Post-exploitation impact. From that point, every agent action, memory write, and Telegram message performed under the now-swapped session is associated with the attacker's backend account. Confidentiality and integrity are both compromised (C:H/I:H): the attacker can observe the victim's agent activity and any data the agent reads or records, and can influence the memory/state tied to that session. Availability is unaffected (A:N), consistent with the CVSS vector.

Prerequisites that constrain exploitation: OpenHuman core must be running with the loopback listener active on port 7788, the victim must visit the attacker's page (UI:R), and the attacker must hold a valid OpenHuman account to generate their token. No authentication to the target endpoint is needed (PR:N).

Impact Assessment

The blast radius is limited to OpenHuman users running the local core — a targeted-desktop scenario rather than a mass-internet exposure, since the vulnerable listener is loopback-only. However, the consequence is severe for affected individuals: session hijack via account swap gives a passive attacker visibility into everything flowing through the agent harness (prompts, memory store, Telegram messaging) and the ability to manipulate that state. The confidentiality and integrity ratings (High/High) reflect that the attacker gains durable, authenticated access to the victim's agent workflow without ever touching the victim's credentials.

Business impact centers on data disclosure of agent-processed content and tampering with learned memory, which can include sensitive chat data and any material the agent ingests. Because the swap is silent, victims may not notice their actions are being attributed to another account. The AV:N rating indicates remote initiation, though exploitation still depends on UI:R (victim visit) and local listener availability. CVSS 8.1 (High) places this above the typical severity threshold for urgent remediation once a fixed build exists.

Detection Guidance

Sigma Rule

title: OpenHuman Localhost Telegram Auth CSRF (CVE-2026-49410)
id: 8f2c1a7e-4b6d-4e21-9c3a-0d5e7b1f2a90
status: experimental
description: Detects cross-site requests to the OpenHuman loopback Telegram auth callback with foreign Origin/Referer indicating CSRF against the desktop core on port 7788.
author: threat-intel
logsource:
  category: webserver
  product: openhuman
detection:
  selection_path:
    cs-uri-query|contains: '/auth/telegram'
  selection_origin:
    cs-header|re: '^(Origin|Referer):\s*https?://(?!127\.0\.0\.1|localhost)'
  condition: selection_path and selection_origin
  falsepositives:
    - Legitimate Telegram OAuth redirects from Telegram domains after allowlisting
level: high
tags:
  - attack.t1204
  - cve.2026-49410
  - cwe.352

YARA Rule

rule CVE_2026_49410_OpenHuman_Telegram_CSRF_Page
{
    meta:
        description = "Detects web content attempting to trigger the OpenHuman loopback Telegram auth callback (CVE-2026-49410)"
        author = "threat-intel"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-49410"
        cve = "CVE-2026-49410"
        date = "2026-01-01"
    strings:
        $cb1 = "127.0.0.1:7788/auth/telegram" ascii wide nocase
        $cb2 = "localhost:7788/auth/telegram" ascii wide nocase
        $cb3 = "/auth/telegram" ascii wide nocase
        $t1  = "telegram" ascii wide nocase
        $tag_img = "<img" ascii wide nocase
        $tag_iframe = "<iframe" ascii wide nocase
        $tag_fetch = "fetch(" ascii wide nocase
    condition:
        ($cb1 or $cb2 or ($cb3 and $t1)) and
        any of ($tag_*)
}

Suricata IDS Rule

alert http $HOME_NET any -> $HOME_NET 7788 (msg:"CVE-2026-49410 OpenHuman Telegram Auth CSRF - loopback callback with foreign origin"; flow:to_server,established; http.method; content:"GET"; http.uri; content:"/auth/telegram"; http.header_names; content:"|0D 0A|Origin|0D 0A|"; pcre:"/^Origin\x3a\s*https?:\/\/(?!127\.0\.0\.1|localhost)/mH"; reference:cve,2026-49410; reference:url,nvd.nist.gov/vuln/detail/CVE-2026-49410; classtype:web-application-attack; sid:202649410; rev:1;)

Elastic Detection

sequence by host.id with maxspan=5s
  [ network where destination.port == 7788 and
      url.path == "/auth/telegram" and
      http.request.method == "GET" ]
  [ process where event.type == "start" ]

Splunk SPL Query

index=web src=127.0.0.1 OR src=localhost
| eval uri=coalesce(url,uri_path,cs_uri)
| eval org=coalesce(http_origin,cs_Origin,"")
| where like(uri,"%/auth/telegram%") AND NOT (like(org,"%127.0.0.1%") OR like(org,"%localhost%"))
| table _time host src uri org user_agent
| sort - _time

Wazuh OSSEC Rule

<group name="openhuman,web,csrf,">
  <rule id="100410" level="12">
    <if_sid>31100,31101</if_sid>
    <match>\/auth\/telegram</match>
    <description>CVE-2026-49410: OpenHuman loopback Telegram auth callback accessed (possible CSRF)</description>
    <mitre>
      <id>T1204</id>
    </mitre>
    <group>cve_2026_49410,</group>
  </rule>
  <rule id="100411" level="14">
    <if_sid>100410</if_sid>
    <match>Origin:|Referer:</match>
    <regex>Origin:\s*https?://(?!127\.0\.0\.1|localhost)</regex>
    <description>CVE-2026-49410: Cross-origin request to OpenHuman Telegram callback - active exploit attempt</description>
    <group>cve_2026_49410,</group>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 (UNPATCHED — no patch evidence from any tracked source). The NVD record states the issue is fixed in version 0.56.0; this version reference is the primary remediation target, but no independent patch source has been verified in this dataset.

1. Immediate mitigations

   • Upgrade to OpenHuman 0.56.0 or later, which the advisory states fixes the missing origin/fetch-metadata validation in telegram_auth_handler. Where upgrading is not immediately possible, stop the local core (close the desktop app or disable the port 7788 listener) when the Telegram auth flow is not in use.
   • Restrict ability of browsers to reach loopback: where policy permits, apply browser extensions/policies that block requests to 127.0.0.1:7788 and localhost:7788, and consider host firewall rules that limit who may reach the loopback listener.
   • Educate users that the only legitimate trigger for the Telegram login is a Telegram-initiated flow; treat unexpected "please retry login" prompts from untrusted pages with suspicion.

2. Patch/upgrade steps

   • Pull the 0.56.0 release of the OpenHuman desktop application and rebuild/re-vendor the Rust library dependency to ≥ 0.56.0.
   • After upgrading, verify the handler now rejects cross-origin requests (foreign Origin/Sec-Fetch-Site values) and that only locally-originated requests complete the Telegram exchange.
   • Restart the local core and confirm a fresh session is established under the user's own account.

3. Long-term hardening

   • Require origin and fetch-metadata validation on all loopback callbacks; reject cross-site requests by default.
   • Bind state-changing operations to POST with CSRF tokens or a per-process secret delivered to the trusted front-end only.
   • Treat any unauthenticated loopback endpoint as internet-reachable-from-the-browser and threat-model accordingly; add regression tests for CSRF on OAuth-style localhost callbacks.
   • Monitor for anomalous account-swap events (session identity changes without a fresh login) in agent telemetry.

References

• NVD — CVE-2026-49410: https://nvd.nist.gov/vuln/detail/CVE-2026-49410
• CWE-352 Cross-Site Request Forgery: https://cwe.mitre.org/data/definitions/352.html
• OpenHuman project (source & release notes for 0.56.0): https://github.com/ — confirm the project's canonical repository and release/tag page for 0.56.0 before relying on it.
• OWASP — CSRF prevention / localhost callback risks: https://owasp.org/www-community/attacks/csrf
• CVSS v3.1 specification (vector interpretation): https://www.first.org/cvss/v3.1/specification-document

No threat actor campaigns or exploit-in-the-wild evidence are available for CVE-2026-49410 in the provided data. CISA KEV status: not listed. No public PoC, exploit code, or Nuclei template is currently known; exploitation details above are inferred from the CSRF vulnerability class and the NVD description.