# Report a vulnerability: Unauthenticated Socket.IO JSON-RPC bypass exposes protected local core methods

This submission will only be viewable to repository maintainers. You will be credited if the advisory is published.

## Advisory Details

### Title *

Unauthenticated Socket.IO JSON-RPC bypass exposes protected local OpenHuman core methods

### Description *

### Summary

OpenHuman's core server protects HTTP JSON-RPC at `/rpc` with a per-process bearer token, but the Socket.IO transport accepts unauthenticated clients and exposes a generic `rpc:request` event that directly invokes the same JSON-RPC dispatcher. A malicious local process, or a malicious web page opened by the user that connects to the local Socket.IO endpoint, can call protected `openhuman.*` methods without knowing the bearer token.

Confirmed reachable impact includes local session JWT disclosure, configuration/API-key disclosure, session clearing/logout, and destructive local-data reset. The issue is present in the default/common desktop and standalone core configurations because Socket.IO is enabled by default.

### Details

Affected version evidence:

- Root Rust crate `openhuman` is version `0.53.47` at `Cargo.toml:1-3`.
- Desktop app package `openhuman-app` is version `0.53.47` at `app/package.json:1-3`.
- Audited commit: `04a548f20f5318da2d2ccdf840b82a71cd99bdcb`.

The intended authentication boundary exists for HTTP JSON-RPC. `src/core/auth.rs:52-60` lists public paths and does not include `/rpc`, while `src/core/auth.rs:128-175` enforces `Authorization: Bearer <token>` on protected requests. In the Tauri path, `app/src-tauri/src/core_process.rs:34-44` generates a 256-bit RPC token, and `app/src-tauri/src/core_process.rs:190-195` injects it into the embedded core through `OPENHUMAN_CORE_TOKEN`. The core-side auth loader consumes that environment token at `src/core/auth.rs:95-102`.

The vulnerable path is separate from this HTTP middleware boundary:

```text
unauthenticated Socket.IO/WebSocket client
  -> /socket.io/ namespace "/"
  -> socket event "rpc:request"
  -> attacker-controlled { method, params }
  -> core::jsonrpc::invoke_method(...)
  -> full registered JSON-RPC controller registry
  -> sensitive OpenHuman local methods
```

`src/core/jsonrpc.rs:547-569` builds the Axum router with the auth middleware and then attaches the Socket.IO layer when Socket.IO is enabled. `src/core/jsonrpc.rs:883-887` logs Socket.IO as available at `/socket.io/` on the same HTTP server. The standalone CLI enables Socket.IO by default through `socketio_enabled = true` in `src/core/cli.rs:214-218`, and the desktop embedded core starts the server with Socket.IO enabled at `app/src-tauri/src/core_process.rs:185-195` plus the embedded `run_server_embedded(..., true, ...)` call in that startup path.

`src/core/socketio.rs:169-177` creates the Socket.IO layer and registers namespace `/`. `src/core/socketio.rs:177-193` accepts a client, joins rooms, and emits `ready` without validating a bearer token, Origin, nonce, or per-connection capability. The generic RPC event is registered at `src/core/socketio.rs:195-230`; the sink is `src/core/socketio.rs:207-213`, which calls `crate::core::jsonrpc::invoke_method(...)` with attacker-controlled `payload.method` and `payload.params`.

The dispatcher then reaches the same controller surface as authenticated HTTP RPC. `src/core/jsonrpc.rs:278-299` validates params against the registered schemas and invokes the matching registered method, falling back to dynamic dispatch if needed.

Examples of confirmed sensitive sinks reachable through this path:

1. Session JWT disclosure:
   - `openhuman.auth_get_session_token` is exposed by schema at `src/openhuman/credentials/schemas.rs:203-209`.
   - The handler delegates to the token-returning implementation at `src/openhuman/credentials/schemas.rs:352-356`.
   - `src/openhuman/credentials/ops.rs:327-335` returns `json!({ "token": token })`.

2. Configuration and API-key disclosure:
   - `openhuman.config_get` returns the current configuration snapshot at `src/openhuman/config/schemas.rs:779-781`.
   - `src/openhuman/config/ops.rs:159-167` serializes the full `Config` into the `config` JSON value.
   - `Config` includes serializable secret-bearing fields such as `api_key` at `src/openhuman/config/schema/types.rs:31-47`.

3. Session clearing / forced logout:
   - `openhuman.auth_clear_session` is exposed at `src/openhuman/credentials/schemas.rs:189-195` and handled at `src/openhuman/credentials/schemas.rs:338-342`.
   - `src/openhuman/credentials/ops.rs:283-318` removes the stored app session, clears the active user marker, and stops login-gated services.

4. Destructive local-data reset:
   - `openhuman.config_reset_local_data` is handled at `src/openhuman/config/schemas.rs:1039-1041`.
   - `src/openhuman/config/ops.rs:998-1004` loads the active config paths and dispatches to the reset helper.
   - `src/openhuman/config/ops.rs:95-157` removes the active workspace marker and deletes local OpenHuman data directories via `remove_file` / `remove_dir_all`.

The missing mitigation is that Socket.IO connection setup and the `rpc:request` event do not enforce any of the authentication/authorization controls used by `/rpc`. There is no bearer-token check, no Origin validation, no authenticated socket session, no method allowlist, and no per-method authorization gate before dispatching to the full controller registry.

### Impact

An unauthenticated attacker who can connect to the victim's local OpenHuman core Socket.IO endpoint can invoke protected JSON-RPC methods. Practical attacker sources include a local process on the same machine, or a malicious web page visited by the user that opens a WebSocket/Socket.IO connection to `127.0.0.1` and relies on the server's lack of Origin validation.

Impact includes stealing the stored OpenHuman backend session JWT, reading configured API keys and local configuration paths, forcing logout/session clearing, changing local configuration, and wiping local OpenHuman data. No bearer token or prior OpenHuman authentication is required for the Socket.IO path. For a browser-origin attack, the victim must visit an attacker-controlled page.

## Affected products

### Ecosystem

other

### Package name

openhuman / openhuman-app

### Affected versions

<= 0.53.47; confirmed at commit `04a548f20f5318da2d2ccdf840b82a71cd99bdcb`

### Patched versions

not yet patched / unknown

## Severity

### Severity

High

### Vector string

`CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H`

### CVSS score

8.8

## Weaknesses

### Common weakness enumerator (CWE)

CWE-306 Missing Authentication for Critical Function; CWE-346 Origin Validation Error