CVE-2026-49393

OpenHuman is an open-source agent harness available as a desktop application and Rust library. Before 0.56.0, the core server protects HTTP POST requests to /rpc with bearer middleware but exposes Socket.IO rpc:request and chat:start handlers without equivalent transport or handler-level...

CVE-2026-49393 OpenHuman: Unauthenticated Socket.IO RPC bypass allows invoking protected OpenHuman core controllers without the Bearer token

OpenHuman is an open-source agent harness available as a desktop application and Rust library. Before 0.56.0, the core server protects HTTP POST requests to /rpc with bearer middleware but exposes Socket.IO rpc:request and chat:start handlers without equivalent transport or handler-level...

CVE-2026-49393

The OpenHuman agent harness (desktop application and Rust library) is vulnerable to an authentication bypass in versions prior to 0.56.0 . The core server fails to apply bearer middleware to Socket.IO rpc:request and chat:start handlers, even though it protects HTTP POST requests to /rpc. A local...