CVE-2026-123094
MediumCVSS 5.4Exploitation Probability (EPSS)
Low risk7th percentile - higher than 7% of all known CVEs
Summary
Huginn before 2026.11.05 contains a stored cross-site scripting vulnerability in the service_label helper that marks unescaped OAuth service display names as html_safe. Authenticated attackers can connect an OAuth account with a crafted nickname, name or email and share it globally, executing JavaScript when victims attach it to Agents and view them.
Risk Assessment
Credentials, Agents and Events may be exposed, and admin actions may be performed if the victim is an administrator. The risk affects multi-user Huginn instances.
Recommendation
Update Huginn to 2026.11.05 or later. Restrict the ability to share OAuth accounts between users.
Other vulnerabilities in Huginn
Original NVD description (English source)
Huginn before 2026.11.05 contains a stored cross-site scripting vulnerability in the service_label helper that marks unescaped OAuth service display names as html_safe. Authenticated attackers can connect an OAuth account with a crafted nickname, name or email and share it globally, executing JavaScript when victims attach it to Agents and view them, exposing Credentials, Agents and Events, and admin actions if the victim is an administrator.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS