Vulnerability · Published Nov 5, 2026 · Assigned by VulnCheck

CVE-2026-123094Huginn before 2026.11.05 Stored XSS via OAuth Service Display Name

Medium 5.4

In plain English

A medium-severity cross-site scripting in huginn from huginn. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 7% of all known vulnerabilities).

Severity (CVSS 3.1)5.4Medium

Exploit odds (30 days)0.2%top 92.6% of all CVEs

Exploited in the wildNo reportsnot in CISA KEV

Attack toolingNoneno public tooling known

Official description

Huginn before 2026.11.05 contains a stored cross-site scripting vulnerability in the service_label helper that marks unescaped OAuth service display names as html_safe. Authenticated attackers can connect an OAuth account with a crafted nickname, name or email and share it globally, executing JavaScript when victims attach it to Agents and view them, exposing Credentials, Agents and Events, and admin actions if the victim is an administrator.

Affected products (as reported)

Vendor	Product	Versions
huginn	huginn	0 – before 2026.11.05

Weakness: CWE-79 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

References

GitHub Security Advisory (GHSA-rjw9-xx87-f2ww) vendor-advisory
https://github.com/huginn/huginn/commit/92229a5e7343bfffc740d31e42b9654b212b678b patch
https://github.com/huginn/huginn/blob/v2026.11.01/app/helpers/application_helper.rb#L78-L88 technical-description
https://hackmd.io/@leediay/SJtUoLFTfx third-party-advisory
huginn v2026.11.05 Release Notes release-notes
https://github.com/huginn/huginn product
VulnCheck Advisory: Huginn before 2026.11.05 Stored XSS via OAuth Service Display Name third-party-advisory