CVE-2026-122236 OpenHands Landing missing authentication

Description

A vulnerability has been found in OpenHands up to 1.24.0. This impacts an unknown function of the component Landing Page. Such manipulation leads to missing authentication. The attack must be carried out from within the local network. The exploit has been disclosed to the public and may be used. Upgrading to version 1.25.0 will fix this issue. The name of the patch is c5efa3ae415def0a903c82d2b17b748e663b1995. Upgrading the affected component is recommended.

Exploitable from the adjacent network, without an account and without any user action; the impact on data or service is limited.

Attack vector

Adjacent network

Attack complexity

Low

Attack requirements

None

Privileges required

None

Interaction

None

Confidentiality

Low

Integrity

Low

Availability

Low

Confidentiality of other systems

None

Integrity of other systems

None

Availability of other systems

None

Affected products and versions