CVE-2026-123094
Huginn before 2026.11.05 Stored XSS via OAuth Service Display Name
CVSS Score
5.4
EPSS Score
0.0%
EPSS Percentile
0th
Huginn before 2026.11.05 contains a stored cross-site scripting vulnerability in the service_label helper that marks unescaped OAuth service display names as html_safe. Authenticated attackers can connect an OAuth account with a crafted nickname, name or email and share it globally, executing JavaScript when victims attach it to Agents and view them, exposing Credentials, Agents and Events, and admin actions if the victim is an administrator.
| CWE | CWE-79 |
| Vendor | huginn |
| Product | huginn |
| Published | Nov 5, 2026 |
Stay Ahead of the Next One
Get instant alerts for huginn huginn
Be the first to know when new medium vulnerabilities affecting huginn huginn are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
CVSS v3 Breakdown
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N Attack Vector
Network
Attack Complexity
Low
Privileges Required
Low
User Interaction
Required
Scope
Changed
Confidentiality
Low
Integrity
Low
Availability
None
Affected Versions
huginn / huginn
0 < 2026.11.05
References
github.com: https://github.com/huginn/huginn/security/advisories/GHSA-rjw9-xx87-f2ww github.com: https://github.com/huginn/huginn/commit/92229a5e7343bfffc740d31e42b9654b212b678b github.com: https://github.com/huginn/huginn/blob/v2026.11.01/app/helpers/application_helper.rb#L78-L88 hackmd.io: https://hackmd.io/@leediay/SJtUoLFTfx github.com: https://github.com/huginn/huginn/releases/tag/v2026.11.05 github.com: https://github.com/huginn/huginn vulncheck.com: https://www.vulncheck.com/advisories/huginn-before-2026.11.05-stored-xss-via-oauth-service-display-name
Credits
leediay153 from Viettel Post Akinori Musha