Bug 2567674 (CVE-2026-123094)

Summary: CVE-2026-123094 huginn: Huginn: Stored cross-site scripting via crafted OAuth service display names
Product: [Other] Security Response Reporter: OSIDB Bzimport <bzimport>
Component: vulnerabilityAssignee: Product Security DevOps Team <prodsec-dev>
Status: NEW --- QA Contact:
Severity: medium Docs Contact:
Priority: medium    
Version: unspecifiedKeywords: Security
Target Milestone: ---   
Target Release: ---   
Hardware: All   
OS: Linux   
Whiteboard:
Fixed In Version: Doc Type: ---
Doc Text:
A flaw was found in Huginn. The application improperly handles OAuth service display names, resulting in a stored cross-site scripting (XSS) vulnerability. An authenticated attacker can exploit this issue by registering an account with crafted display names or email addresses and sharing it globally across the platform. When other users or administrators view agents linked to the malicious service, arbitrary script executes within their browser sessions, potentially exposing sensitive credentials and enabling unauthorized actions.
 Story Points: ---
Clone Of: Environment:
Last Closed: Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:

Description OSIDB Bzimport 2026-11-05 22:17:08 UTC 
Huginn before 2026.11.05 contains a stored cross-site scripting vulnerability in the service_label helper that marks unescaped OAuth service display names as html_safe. Authenticated attackers can connect an OAuth account with a crafted nickname, name or email and share it globally, executing JavaScript when victims attach it to Agents and view them, exposing Credentials, Agents and Events, and admin actions if the victim is an administrator.