CVE-2026-54145

OpenHuman approval records expose the core authorization token

Tiny Humans · OpenHuman approval records

First documented disclosure · Review checkpoint

Summary

Approval records, notifications and logs can expose the core authorization token.

Severity and exploitation evidence

High · 8.8/10 · CVSS 3.1. Severity source.

Exploitation not established: The reviewed public sources describe the vulnerability and its conditions. Malicious exploitation has not been established in the reviewed sources.

Exploitation evidence source

Technical severity is not a measure of observed attacks or of risk to your deployment. Attempts, demonstrations, and successful compromise retain the qualifications in the source.

How the weakness works

The approval service reused a bearer credential as its session identifier in stored and transmitted approval metadata.

Conditions required

An actor must gain access to an affected approval record, debug log, notification or exposed approval data.

Potential impact

The credential may be reused to access privileged core operations.

Affected versions and configurations

Before 0.57.5.

Fix and mitigation status

0.57.5.

Practical next steps

Update to 0.57.5 and rotate exposed credentials or restart affected sessions as appropriate.

Operating lesson

Keep authentication secrets out of correlation identifiers and logs.

Evidence and limits

The dated public project record and the later CVE describe the same affected component. The fixed version is identified by the project or assigning authority.

Sources