OpenHuman is an open‑source agent harness that offers a desktop application and Rust library. Prior to version 0.56.0 the core server requires a bearer token for HTTP POST requests to /rpc, but the Socket.IO rpc:request and chat:start handlers are exposed without equivalent authentication. A local unauthenticated client can connect to the Socket.IO namespace and dispatch requests to controller paths that otherwise reject a missing bearer token. This bypass allows an attacker to read configuration or health data, start or stop agent flows, interact with integrated account APIs, alter local data, or control the service lifecycle, effectively giving the attacker privilege escalation and information disclosure capabilities within the local environment.

The vulnerability affects the OpenHuman product from tinyhumansai, in all releases prior to version 0.56.0. Users running older versions should upgrade or apply the appropriate mitigation steps.

The CVSS score of 8.4 indicates a high severity level. No EPSS score is available, but the lack of authentication makes the vulnerability straightforward to exploit for local actors. The CISA KEV catalog does not list this issue, so there is no evidence of active exploitation yet. The attack vector is local – an attacker who can run code on the same machine can immediately dispatch requests through the unprotected Socket.IO endpoints to perform privileged actions, potentially leading to service disruption or data tampering.