โ† ุงู„ุนูˆุฏุฉ ู„ู„ุฌุฏูˆู„
CVE-2026-49410
CVE-2026-49410 - OpenHuman /auth/telegram CSRF allows attacker-controlled session implantation
๐Ÿ“… 2026-10-17 01:17:23
๐Ÿ”ด Critical ๐Ÿ”ฅ No MITRE CVE High Vulnerability Web

๐Ÿ“‹ ุงู„ูˆุตู ุงู„ูƒุงู…ู„

CVE ID :CVE-2026-49410 Published : Oct. 16, 2026, 10:17 p.m. | 4ย hours, 10ย minutes ago Description :OpenHuman is an open-source agent harness available as a desktop application and Rust library. Versions before 0.56.0 allow cross-site request forgery against the unauthenticated GET /auth/telegram loopback callback because telegram_auth_handler consumes an attacker-supplied one-time

๐Ÿ’ป ุงู„ุฃู†ุธู…ุฉ ุงู„ู…ุชุฃุซุฑุฉ

โš ๏ธ ู†ูˆุน ุงู„ุชู‡ุฏูŠุฏ

Vulnerability

๐Ÿ”— CVE ID

CVE-2026-49410

๐Ÿ“ก ุงู„ู…ุตุฏุฑ

MITRE CVE High

โœ… ุงู„ุญู„ูˆู„ ูˆุงู„ุชุฎููŠู

Update to v0.56.0

๐Ÿ”— ุงู„ู…ุตุฏุฑ ุงู„ุฃุตู„ูŠ โ† ๐Ÿ“˜ NVD โ† โšก CISA KEV โ† ๐Ÿ” Valters IT โ†