What happened
NVD REST verified (published 2026-10-16, CVSS 8.1, HIGH). The agent harness's unauthenticated Telegram OAuth loopback endpoint consumes a caller-supplied one-time token with no origin/fetch-metadata validation, enabling CSRF session hijack of a running local agent.
Why it matters
This is session compromise of an agent harness that holds the user's agent memory and messaging channels. A single malicious page can silently reroute the agent's ongoing work onto the attacker's account, letting the attacker observe prompts, memory writes, and Telegram content while the victim believes the session is intact — a direct prompt-to-agent identity attack on an agentic personal-computing deployment.
Attack vector
Cross-site request forgery (CWE-352/384) against the unauthenticated GET /auth/telegram loopback callback: telegram_auth_handler consumes an attacker-supplied one-time Telegram login token and stores the returned JWT without validating browser fetch metadata or the request origin. A victim visiting a malicious page while the local core runs gets their session switched to the attacker's account; all subsequent agent actions and memory become visible to the attacker.
Affected systems
OpenHuman (tinyhumansai/openhuman) < 0.56.0
Mitigation
Upgrade to OpenHuman 0.56.0 (fix commit b1bbc53; GHSA-c4m9-hw7m-vv3m). Until patched, do not browse untrusted sites while the core is running, or bind/guard the loopback callback.