OpenHuman on macOS exposes auth token in process environment
OpenHuman app passwords on Macs can be stolen by other programs in your account.
Summary
OpenHuman's desktop app on macOS leaves its access token in the process environment, so another program running as the same user can read it and control the app's services. Versions from 0.53.15 before 0.57.5 are affected.
Affected when
- macOS
- OpenHuman 0.53.15 or later, before 0.57.5
- another program running as the same user
What to do
Update OpenHuman to 0.57.5 or later.
Products and platforms
CVE IDs
Times
First published
First seen