CVE-2026-49405 | TinyHumansAI OpenHuman up to 0.55.x Server-Sent Events Endpoint client_id cross-domain policy

A vulnerability has been found in TinyHumansAI OpenHuman up to 0.55.x and classified as problematic. This impacts an unknown function of the component Server-Sent Events Endpoint. This manipulation of the argument client_id causes permissive cross-domain policy with untrusted domains.

The identification of this vulnerability is CVE-2026-49405. It is possible to initiate the attack remotely. There is no exploit available.

The affected component should be upgraded.VulDB Recent EntriesRead More