CVE-2026-49407

OpenHuman is an open-source agent harness available as a desktop application and Rust library. Before version 0.57.44, its local  /ws/dictation  WebSocket endpoint lacks client authentication and browser-origin validation. An unauthenticated client, including a malicious web page able to reach the endpoint, can submit audio and trigger resource-intensive speech-to-text processing. Earlier affected versions also accumulate audio in an unbounded buffer, allowing continuous streaming to exhaust process memory. These conditions can degrade performance, exhaust resources, or crash the application. This issue is fixed in version 0.57.44.

• CWE-306
• CWE-400
• CWE-770

• https://github.com/tinyhumansai/openhuman/commit/2944b83fc0da61edb3c461243593cdb64de74efe
• https://github.com/tinyhumansai/openhuman/commit/cf5dd2d7c7897218e704c58268fc48decb63202c
• https://github.com/tinyhumansai/openhuman/pull/2238
• https://github.com/tinyhumansai/openhuman/pull/3652
• https://github.com/tinyhumansai/openhuman/releases/tag/v0.57.44
• https://github.com/tinyhumansai/openhuman/security/advisories/GHSA-mfwq-rpj4-38xh

Published

Nov 5, 2026

Last Modified

Nov 5, 2026

Status

Received

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-49397Nezha Monitoring is a self-hostable, lightweight, servers an…5.3
• CVE-2026-49400October System provides the system module for October Conten…3.3
• CVE-2026-49401Deno is a JavaScript, TypeScript, and WebAssembly runtime. P…8.4
• CVE-2026-49402Deno is a JavaScript, TypeScript, and WebAssembly runtime. P…8.1
• CVE-2026-49405OpenHuman is an open-source agent harness available as a des…6.2
• CVE-2026-49406Deno is a JavaScript, TypeScript, and WebAssembly runtime. P…5.5
• CVE-2026-49410OpenHuman is an open-source agent harness available as a des…8.1
• CVE-2026-49411Deno is a JavaScript, TypeScript, and WebAssembly runtime. P…6.5
• CVE-2026-49412The kernel handler for IPV6_MSFILTER dropped a serializing l…7.8
• CVE-2026-49413The Linuxulator determined whether a binary was set-user-ID …7.1
• CVE-2026-49414The ELF image activator cleared per-process ASLR preference …7.8
• CVE-2026-49415During execve(2) of a SUID binary, the new virtual address s…8.8