CVE-2026-49410

Versions before 0.56.0 of OpenHuman , an open-source agent harness, are vulnerable to a Cross-Site Request Forgery (CSRF) . The root cause is that the telegram_auth_handler consumes an attacker-supplied one-time Telegram login token and passes the resulting JWT to credentials::ops::store_session ...