CVE-2026-49410 OpenHuman /auth/telegram CSRF allows attacker-controlled session implantation

OpenHuman is an open-source agent harness available as a desktop application and Rust library. Versions before 0.56.0 allow cross-site request forgery against the unauthenticated GET /auth/telegram loopback callback because telegramauthhandler consumes an attacker-supplied one-time Telegram login...