CVE-2026-49407

OpenHuman dictation sessions accept unauthenticated audio

Tiny Humans · OpenHuman dictation

First documented disclosure · Review checkpoint

Summary

Unauthenticated dictation sessions can accept audio and exhaust memory.

Severity and exploitation evidence

High · 7.7/10 · CVSS 3.1. Severity source.

Exploitation not established: The reviewed public sources describe the vulnerability and its conditions. Malicious exploitation has not been established in the reviewed sources.

Exploitation evidence source

Technical severity is not a measure of observed attacks or of risk to your deployment. Attempts, demonstrations, and successful compromise retain the qualifications in the source.

How the weakness works

The dictation listener lacked client authentication and limits on accumulated audio data.

Conditions required

A client must be able to reach the local dictation service.

Potential impact

Unauthorized audio processing can degrade performance, exhaust memory or crash the application.

Affected versions and configurations

Before 0.57.44.

Fix and mitigation status

0.57.44.

Practical next steps

Update to 0.57.44 and verify authentication and session resource limits.

Operating lesson

Enforce identity and resource limits when a streaming connection opens.

Evidence and limits

The dated public project record and the later CVE describe the same affected component. The fixed version is identified by the project or assigning authority.

Sources