Dashboard / CVE-2026-123094

CVE-2026-123094

MEDIUM
MEDIUM Priority: 0.01 BB Relevance: 50/100
Published: 2026-11-05 Modified: 2026-11-12 First seen: 2026-11-05 Status: active

Attack Surface

Network Low Complexity

CVSS Vector Breakdown

AV: Network
AC: Low
PR: Low
UI: Passive
S: X
AT: None
VC: None
VI: None
VA: None

Description

Huginn before 2026.11.05 contains a stored cross-site scripting vulnerability in the service_label helper that marks unescaped OAuth service display names as html_safe. Authenticated attackers can connect an OAuth account with a crafted nickname, name or email and share it globally, executing JavaScript when victims attach it to Agents and view them, exposing Credentials, Agents and Events, and admin actions if the victim is an administrator.

Weakness Classification (1)

Affected Software (2)

VendorProductVersion
huginn huginn 0 < 2026.11.05
huginn huginn 0 < 2026.11.05

References & Advisories (7)

Bug Bounty Relevance

50 / 100
✓ Network accessible
✓ Low complexity

CVSS Score

5.1 / 10.0 v4.0
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

EPSS — Exploitation Probability

0.18%
Raw Score 0.001780
Percentile 7.4%
Date 2026-11-13

EPSS Trend

2026-11-13
0.00178
2026-11-12
0.00178
2026-11-10
0.00178
2026-11-09
0.00178
2026-11-08
0.00178
2026-11-07
0.00178
2026-11-06
0.00178

Intelligence Sources

mitre ref →
nvd ref →

External Links