The vulnerability is a stored cross‑site scripting flaw in Huginn's service_label helper that treats unescaped OAuth service display names as safe HTML. An authenticated attacker who can connect an OAuth account with a crafted nickname, name or email can share it globally. When a victim views an Agent that references this account, the browser executes attacker‑supplied JavaScript, exposing credentials, agent data, events and even allowing execution of admin actions if the victim is an administrator.

Huginn versions earlier than 2026.11.05 are affected. The vulnerability applies to the huginn:huginn product as identified by the CNA. All installations running a version prior to the 2026.11.05 release are vulnerable.

The CVSS score for this flaw is 5.1, which is a medium severity. The EPSS score is not available, and the vulnerability is not listed in the CISA KEV catalog, indicating no publicly known exploitation. The attack requires an authenticated attacker to create a malicious OAuth display name and share it globally; the victim must then view an Agent that references the account for the XSS payload to execute. Because it is a client‑side flaw, the exploitation surface is limited to users who view affected Agents, and only if they are logged in or view sensitive data. The risk is moderate but could lead to credential theft or privilege escalation if the victim is an administrator.