CVE-2026-49405

OpenHuman is an open-source agent harness available as a desktop application and Rust library. Before 0.56.0, the local server exposes the server-sent events endpoint at /events without bearer authentication, permits cross-origin browser access, and uses only a caller-supplied clientid to select...

EUVD-2026-117619

OpenHuman is an open-source agent harness available as a desktop application and Rust library. Before 0.56.0, the local server exposes the server-sent events endpoint at /events without bearer authentication, permits cross-origin browser access, and uses only a caller-supplied clientid to select...

CVE-2026-49405 OpenHuman: Unauthenticated server-sent events endpoint leaks user-facing event data

OpenHuman is an open-source agent harness available as a desktop application and Rust library. Before 0.56.0, the local server exposes the server-sent events endpoint at /events without bearer authentication, permits cross-origin browser access, and uses only a caller-supplied clientid to select...

CVE-2026-49405

Prior to version 0.56.0 , the OpenHuman agent harness (desktop application and Rust library) contains a vulnerability where the local server's server-sent events endpoint at /events lacks bearer authentication. The application permits cross-origin browser access and relies solely on a caller-supp...