Summary
OpenHuman contains a cross-site request forgery vulnerability in its unauthenticated local Telegram authentication callback. A malicious webpage may cause a user with the local OpenHuman core running to switch the active session to an attacker-controlled account, potentially exposing later agent activity and connected messages.
OpenHuman contains a cross-site request forgery vulnerability in its unauthenticated local Telegram authentication callback. A malicious webpage may cause a user with the local OpenHuman core running to switch the active session to an attacker-controlled account, potentially exposing later agent activity and connected messages.
Affected context
The issue affects OpenHuman desktop deployments that expose the local
/auth/telegram callback on loopback port 7788 and accept browser requests
without validating their origin or fetch metadata. Risk is present when a
user visits attacker-controlled web content while the local core is running
and the callback can consume a valid one-time Telegram authentication token.
The issue affects OpenHuman desktop deployments that expose the local
/auth/telegram callback on loopback port 7788 and accept browser requests
without validating their origin or fetch metadata. Risk is present when a
user visits attacker-controlled web content while the local core is running
and the callback can consume a valid one-time Telegram authentication token.
Exploit preconditions
- Attack surface: The unauthenticated Telegram authentication callback on the local loopback interface
- Required access: An attacker-controlled webpage and an attacker-owned OpenHuman account
- Victim condition: The user has the OpenHuman local core running and visits the malicious page
- Trigger point: A cross-origin browser request to the local
/auth/telegramendpoint - Why exploitation is possible: The handler accepts the supplied one-time authentication token and stores the resulting JWT without verifying the request origin or browser fetch metadata
- Attack surface: The unauthenticated Telegram authentication callback on the local loopback interface
- Required access: An attacker-controlled webpage and an attacker-owned OpenHuman account
- Victim condition: The user has the OpenHuman local core running and visits the malicious page
- Trigger point: A cross-origin browser request to the local
/auth/telegramendpoint - Why exploitation is possible: The handler accepts the supplied one-time authentication token and stores the resulting JWT without verifying the request origin or browser fetch metadata
Why this happens
The vulnerability results from treating a state-changing authentication callback
as safe to invoke through an unauthenticated cross-origin browser request.
The handler consumes attacker-influenced authentication data and replaces the
locally stored session without enforcing an origin, Fetch Metadata, or equivalent
request-integrity check. This maps primarily to CWE-352: Cross-Site Request Forgery, with session replacement behavior also related to CWE-384: Session Fixation.
The vulnerability results from treating a state-changing authentication callback
as safe to invoke through an unauthenticated cross-origin browser request.
The handler consumes attacker-influenced authentication data and replaces the
locally stored session without enforcing an origin, Fetch Metadata, or equivalent
request-integrity check. This maps primarily to CWE-352: Cross-Site Request Forgery, with session replacement behavior also related to CWE-384: Session Fixation.
Potential impact
- An attacker may switch the victim's active local session to the attacker's account
- Subsequent agent actions may be exposed to or controlled by the attacker
- Local memory writes and other agent-generated data could be associated with the wrong account
- Telegram messages and connected account activity may be disclosed
- The victim's workflow could be disrupted through unauthorized session changes
- An attacker may switch the victim's active local session to the attacker's account
- Subsequent agent actions may be exposed to or controlled by the attacker
- Local memory writes and other agent-generated data could be associated with the wrong account
- Telegram messages and connected account activity may be disclosed
- The victim's workflow could be disrupted through unauthorized session changes
General mitigation guidance
Mitigation generally focuses on protecting local authentication callbacks as
state-changing operations rather than treating them as ordinary GET requests.
Common defensive patterns include:
- Require an unpredictable, user-bound authentication state or nonce for callback completion
- Validate request origin and relevant Fetch Metadata headers where supported
- Prefer browser-safe callback designs that do not perform session mutation solely from ambient requests
- Bind authentication completion to an explicit user interaction or local authorization step
- Reject unexpected cross-origin requests and avoid unauthenticated state-changing GET endpoints
- Store sessions with least privilege and limit the actions available to newly established sessions
- Log and alert on unexpected local session replacement events
Mitigation generally focuses on protecting local authentication callbacks as
state-changing operations rather than treating them as ordinary GET requests.
Common defensive patterns include:
- Require an unpredictable, user-bound authentication state or nonce for callback completion
- Validate request origin and relevant Fetch Metadata headers where supported
- Prefer browser-safe callback designs that do not perform session mutation solely from ambient requests
- Bind authentication completion to an explicit user interaction or local authorization step
- Reject unexpected cross-origin requests and avoid unauthenticated state-changing GET endpoints
- Store sessions with least privilege and limit the actions available to newly established sessions
- Log and alert on unexpected local session replacement events
How teams detect issues like this
Organizations can look for:
- Static analysis rules identifying state-changing GET handlers and authentication callbacks without CSRF protections
- Code review signals such as session writes performed without origin, nonce, or Fetch Metadata validation
- Tests that issue cross-origin requests to local endpoints and verify that session state remains unchanged
- Policy checks requiring CSRF protection for all authentication and session-management operations
- Runtime telemetry for unexpected session replacement, unusual callback requests, or abrupt account changes
Automated security review tools may help identify local web endpoints that mutate credentials without request-integrity checks.
Organizations can look for:
- Static analysis rules identifying state-changing GET handlers and authentication callbacks without CSRF protections
- Code review signals such as session writes performed without origin, nonce, or Fetch Metadata validation
- Tests that issue cross-origin requests to local endpoints and verify that session state remains unchanged
- Policy checks requiring CSRF protection for all authentication and session-management operations
- Runtime telemetry for unexpected session replacement, unusual callback requests, or abrupt account changes
Automated security review tools may help identify local web endpoints that mutate credentials without request-integrity checks.
