CVE-2026-123094
Received Received - Intake

Stored XSS in Huginn via OAuth Service Label

Publication date: 2026-11-05

Last updated on: 2026-11-05

Assigner: VulnCheck

Description
Huginn before 2026.11.05 contains a stored cross-site scripting vulnerability in the service_label helper that marks unescaped OAuth service display names as html_safe. Authenticated attackers can connect an OAuth account with a crafted nickname, name or email and share it globally, executing JavaScript when victims attach it to Agents and view them, exposing Credentials, Agents and Events, and admin actions if the victim is an administrator.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-11-05
Last Modified
2026-11-05
Generated
2026-11-05
AI Q&A
2026-11-05
EPSS Evaluated
N/A
NVD
CVE-2026-123094
EUVD
EUVD-2026-117539

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
huginn huginn 0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-79 The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This is a stored cross-site scripting (XSS) vulnerability in Huginn before version 2026.11.05. It occurs in the service_label helper where OAuth service display names are marked as html_safe without proper escaping. Attackers can inject malicious JavaScript by setting a crafted nickname, name, or email in an OAuth account, which executes when victims view the affected service in their Agents.

Detection Guidance

Check Huginn version with: docker exec <container> bundle exec rake version or grep VERSION config/app.yml. Inspect OAuth service display names and agent descriptions for unexpected JavaScript or HTML tags. Review logs for unusual agent or event modifications.

Impact Analysis

If exploited, this vulnerability allows attackers to execute arbitrary JavaScript in the context of a victim's session. This can lead to exposure of credentials, manipulation of Agents and Events, and unauthorized admin actions if the victim has administrator privileges. The attack requires an authenticated user to create a malicious OAuth account and share it globally.

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive data, violating confidentiality requirements in GDPR and HIPAA. Exposure of credentials or manipulation of Agents handling personal data may result in compliance breaches, data leaks, or unauthorized processing, requiring investigation and potential reporting under these regulations.

Mitigation Strategies

Upgrade Huginn to v2026.11.05 or later. Avoid attaching services from untrusted users until patched. Review and sanitize existing OAuth service names and agent descriptions. Implement CSP headers if not already present.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-123094. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart

Security Radar

News mentioning this vulnerability
Loading related security news...