A cross‑site request forgery flaw in the OpenHuman application allows a malicious attacker to cause a user’s local agent to exchange its current session for one linked to the attacker’s own OpenHuman account. The flaw exists in the unauthenticated GET /auth/telegram loopback callback on port 7788 because the login handler accepts a one‑time Telegram login token and forwards the returned JWT to the session store without checking the originating browser request. The result is that the victim’s active local session is hijacked, giving the attacker full control over subsequent agent actions, memory writes, and Telegram messages tied to that session. The weakness is a classic CSRF (CWE‑352) that also violates valid request origin checks (CWE‑384).

The vulnerability impacts the OpenHuman agent harness provided by tinyhumansai. All OpenHuman releases before version 0.56.0 are affected. Users running these versions on their local machine expose themselves to session hijacking if an attacker can force the victim to visit a malicious page that triggers the local loopback authentication endpoint.

The vulnerability carries a CVSS of 8.1, indicating high severity, and currently has no EPSS score available, so the likelihood of exploitation is unknown. It is not listed in CISA’s KEV catalog. The attack likely occurs when a user with an OpenHuman core running locally is lured to a malicious web page that issues a request to http://localhost:7788/auth/telegram, thereby executing the CSRF payload. Any system with a user who has an OpenHuman account and runs the agent locally is at risk, though the vector requires the victim’s browser to send a request to the loopback interface.