CVE-2026-49405

OpenHuman event subscriptions can expose another client’s events

Tiny Humans · OpenHuman event stream

First documented disclosure · Review checkpoint

Summary

Missing event-stream authentication can disclose user events.

Severity and exploitation evidence

Medium · 6.2/10 · CVSS 3.1. Severity source.

Exploitation not established: CISA enrichment records proof of concept for the event-stream exposure. Malicious exploitation has not been established in the reviewed sources.

Exploitation evidence source

Technical severity is not a measure of observed attacks or of risk to your deployment. Attempts, demonstrations, and successful compromise retain the qualifications in the source.

How the weakness works

Event subscriptions relied on the client identifier without requiring proof of the subscriber’s identity.

Conditions required

A client must reach the event service and know or predict a relevant identifier.

Potential impact

Agent activity and user-facing event data can be disclosed to an unauthorized subscriber.

Affected versions and configurations

Before 0.56.0.

Fix and mitigation status

0.56.0.

Practical next steps

Update to 0.56.0 and bind subscriptions to authenticated sessions.

Operating lesson

Treat stream subscription as a data-access decision.

Evidence and limits

The dated public project record and the later CVE describe the same affected component. The fixed version is identified by the project or assigning authority.

Sources