The vulnerability allows any local user or an attacker’s web page to subscribe to the local server’s server‑sent events endpoint without authentication. Because the endpoint is accessible from any origin and only requires a client identifier, the server publishes assistant responses, tool names, arguments, and raw outputs that were intended for the local UI. This leaks sensitive conversation data and tool usage details, violating confidentiality and privacy. The weakness corresponds to CWE‑200 and CWE‑306.

The flaw exists in versions of TinyHumansAI OpenHuman prior to 0.56.0, affecting the desktop application and the Rust library that host a local HTTP server on the user’s machine.

The CVSS score of 6.2 indicates moderate risk; EPSS data is not available and the issue is not listed in CISA KEV. An attacker can exploit the flaw by hosting a malicious web page that the victim visits, making a cross‑origin request to /events with a guessed or known client identifier. The endpoint’s predictable system identifier makes it easier for an adversary to target a specific user. Once subscribed, the attacker receives real‑time events containing full assistant outputs and tool execution details, potentially revealing sensitive information.