CVE-2026-123094

    Dashboard / Vulnerabilities / CVE-2026-123094

    CVE-2026-123094

    Published: 5 Nov 2026Last Modified: 7 Nov 2026

    Summary: Huginn before 2026.11.05 Stored XSS via OAuth Service Display Name

    Details: Huginn before 2026.11.05 contains a stored cross-site scripting vulnerability in the service_label helper that marks unescaped OAuth service display names as html_safe. Authenticated attackers can connect an OAuth account with a crafted nickname, name or email and share it globally, executing JavaScript when victims attach it to Agents and view them, exposing Credentials, Agents and Events, and admin actions if the victim is an administrator.

    References: https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/123xxx/CVE-2026-123094.json, https://github.com/huginn/huginn/releases/tag/v2026.11.05, https://github.com/huginn/huginn/security/advisories/GHSA-rjw9-xx87-f2ww, https://hackmd.io/@leediay/SJtUoLFTfx, https://nvd.nist.gov/vuln/detail/CVE-2026-123094, https://www.vulncheck.com/advisories/huginn-before-2026.11.05-stored-xss-via-oauth-service-display-name, https://github.com/huginn/huginn/commit/92229a5e7343bfffc740d31e42b9654b212b678b, https://github.com/huginn/huginn, https://github.com/huginn/huginn/blob/v2026.11.01/app/helpers/application_helper.rb#L78-L88

    Affected packages

    Package

    Name:

    Purl:

    Affected ranges

    Type: GIT

    Events:

    Introduced- 0
    Fixed -cdb9f9295d792f7a512a4e2f79a82ae0571c8aa9

    Affected versions

    v2026.11.01

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High
    CVE-2026-123094 | CVE-DB