Auth bypass in Hkuds Openharness
CVE-2026-6729
HKUDS OpenHarness prior to PR #159 remediation contains a session key derivation vulnerability that allows authenticated participants in shared chats or threads to hijack other users' sessions by exploiting a shared ohmo session key that lacks sender identity verification. Attackers can reuse another user's conversation state and replace or interrupt their active tasks by colliding into the same session boundary through the shared chat or thread scope.
Vulnerability class: Broken Authentication
EPSS: 0.002 (9.7th percentile) — read the EPSS interpretation.
CVSS v3 metric
CVSS v3 base score 6.3 (Medium). Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L.
Affected products
- Hkuds Openharness — versions 0
Weakness classification (CWE)
References
- disclosure@vulncheck.com (issue-tracking, Exploit, patch, Issue Tracking)
- disclosure@vulncheck.com (Patch, patch)
- disclosure@vulncheck.com (Third Party Advisory, third-party-advisory)
Frequently asked questions
- What is CVE-2026-6729?
- CVE-2026-6729 is a medium-severity vulnerability in Hkuds Openharness, classified under Improper Authentication. CVSS score: 6.3/10. Published 2026-04-20.
- How severe is CVE-2026-6729?
- Medium severity. CVSS v3 base score is 6.3 out of 10.