{"id":"CVE-2026-54145","published":"2026-11-05T17:18:19.850","lastModified":"2026-11-05T17:18:19.850","description":"OpenHuman is an open-source agent harness available as a desktop application and Rust library. In affected versions before 0.57.5, the approval gate uses the JSON-RPC bearer token as an approval session identifier. This exposes the credential through persisted approval records, events, debug logs, and RPC responses, including during normal desktop operation. An attacker who obtains these artifacts can recover the token and access the core RPC interface while it remains valid. This can expose sensitive agent and integration data and permit privileged operations. Stable tokens remain usable until rotated; launch-specific tokens remain usable while the corresponding core instance is active. The fix is included in version 0.57.5.","cvssScore":8.8,"cvssSeverity":"HIGH","cvssVector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H","cwes":["CWE-200","CWE-312","CWE-532"],"vendors":[],"products":[],"references":[{"url":"https://github.com/tinyhumansai/openhuman/commit/c5ff4a3516a9ad889b19a97eb1bba624908658fe","tags":[]},{"url":"https://github.com/tinyhumansai/openhuman/pull/2952","tags":[]},{"url":"https://github.com/tinyhumansai/openhuman/releases/tag/v0.57.5","tags":[]},{"url":"https://github.com/tinyhumansai/openhuman/security/advisories/GHSA-ww8p-c82p-p8wx","tags":[]}],"exploitRefs":[{"url":"https://github.com/tinyhumansai/openhuman/commit/c5ff4a3516a9ad889b19a97eb1bba624908658fe","tags":[]},{"url":"https://github.com/tinyhumansai/openhuman/pull/2952","tags":[]},{"url":"https://github.com/tinyhumansai/openhuman/releases/tag/v0.57.5","tags":[]},{"url":"https://github.com/tinyhumansai/openhuman/security/advisories/GHSA-ww8p-c82p-p8wx","tags":[]}],"hasPoc":true,"ai":{"summary":"The approval gate in OpenHuman before v0.57.5 incorrectly uses the JSON-RPC bearer token as an approval session identifier, causing the token to be persisted in logs, events, and RPC responses, allowing an attacker with access to these artifacts to recover the token and abuse the RPC interface.","exploitability":"Exploitation requires local access to persisted approval records, debug logs, or RPC responses containing the token; the attacker must also have valid login credentials (PR:L) to trigger the vulnerable flow.","blast_radius":"Successful exploitation grants full access to the core RPC interface while the token is valid, enabling exposure of sensitive agent/integration data and execution of privileged operations.","remediation":"Upgrade to OpenHuman version 0.57.5 or later, which fixes the token handling in the approval gate.","detection":"Defenders should monitor for unexpected persistence of JSON-RPC bearer tokens in approval-related logs, event records, or RPC response payloads; presence of such tokens outside secure storage indicates exposure.","tags":["token-exposure","credential-leak","rpc-abuse","local-access","session-fixation"],"model":"garnet-coder","analyzedAt":"2026-11-06T09:53:41.837Z"}}