OpenHuman dictation WebSocket lacks authentication, allowing resource exhaustion
This desktop AI helper app can be slowed or crashed by a malicious web page.
Summary
OpenHuman's local /ws/dictation WebSocket endpoint has no client authentication or browser-origin validation, so an unauthenticated client or malicious web page can submit audio and exhaust resources or crash the application. Versions before 0.57.44 are affected.
Affected when
- OpenHuman before 0.57.44
What to do
Update to OpenHuman 0.57.44 or later.
Products and platforms
CVE IDs
Sources
- Write-up: github.com (opens in a new tab)
- CVE record: cve.org (opens in a new tab)
Times
First published
First seen