CVE-2026-49407
OpenHuman: Unauthenticated dictation WebSocket allows arbitrary audio streaming and unbounded memory growth
- Published
- Updated
- Reserved
- Assigned by
- GitHub_M
Description
OpenHuman is an open-source agent harness available as a desktop application and Rust library. Before version 0.57.44, its local /ws/dictation WebSocket endpoint lacks client authentication and browser-origin validation. An unauthenticated client, including a malicious web page able to reach the endpoint, can submit audio and trigger resource-intensive speech-to-text processing. Earlier affected versions also accumulate audio in an unbounded buffer, allowing continuous streaming to exhaust process memory. These conditions can degrade performance, exhaust resources, or crash the application. This issue is fixed in version 0.57.44.
Scores
| Scored by | CVSS | Score | Vector |
|---|---|---|---|
| GitHub_MCNA (assigner) | 3.1 | High7.7 | CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H |
| NVDNVD · Deferred | 3.1 | High7.7 | CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H |
- EPSS (exploitation in 30 days)
- 0.29% · top 78% of all CVEs (6 Nov 2026)
The list uses the assigner's score when there is one, then CISA's, then NVD's: High 7.7.
Weakness
- CWE-306: Missing Authentication for Critical Function (opens in a new tab)All about CWE-306 and its CVEs
- CWE-400: Uncontrolled Resource Consumption (opens in a new tab)All about CWE-400 and its CVEs
- CWE-770: Allocation of Resources Without Limits or Throttling (opens in a new tab)All about CWE-770 and its CVEs
Affected products
- affected < 0.57.44
References (6)
- https://github.com/tinyhumansai/openhuman/security/advisories/GHSA-mfwq-rpj4-38xh (opens in a new tab)x_refsource_CONFIRM
- https://github.com/tinyhumansai/openhuman/pull/2238 (opens in a new tab)x_refsource_MISC
- https://github.com/tinyhumansai/openhuman/pull/3652 (opens in a new tab)x_refsource_MISC
- https://github.com/tinyhumansai/openhuman/commit/2944b83fc0da61edb3c461243593cdb64de74efe (opens in a new tab)x_refsource_MISC
- https://github.com/tinyhumansai/openhuman/commit/cf5dd2d7c7897218e704c58268fc48decb63202c (opens in a new tab)x_refsource_MISC
- https://github.com/tinyhumansai/openhuman/releases/tag/v0.57.44 (opens in a new tab)x_refsource_MISC
Sources
The same CVE in the primary databases and aggregators, to check against.
- CVE.org record (opens in a new tab)
- CVE List JSON (GitHub) (opens in a new tab)
- NVD (opens in a new tab)
- FIRST EPSS (opens in a new tab)
- OSV.dev (opens in a new tab)
- GitHub Advisories (opens in a new tab)
- CIRCL Vulnerability-Lookup (opens in a new tab)
Badge for a README or a ticket
[](https://trackcve.app/cve/CVE-2026-49407)Record last updated .