A flaw in the Landing Page of OpenHands permits an attacker to bypass authentication, granting unauthorized local users access to protected functionality. The vulnerability stems from an unprotected function within the Landing component that, when invoked, fails to enforce the expected identity checks, thereby exposing sensitive resources to any user who can reach it from the local network.

The issue affects OpenHands installations using versions up to 1.24.0. The vendor identifies the affected product as OpenHands OpenHands, and the official fix is delivered in release 1.25.0, which includes the patch identified by commit c5efa3ae415def0a903c82d2b17b748e663b1995.

The CVSS score of 5.3 indicates moderate severity; however, the vulnerability is exploitable only from within the local network, so external threat actors would need physical or network access. No EPSS data is available and the issue is not listed in the CISA KEV catalog, suggesting a lower public exploitation risk at present. Nonetheless, the potential for unauthorized internal access means remediation should be prioritized.