CVE-2026-6729

Medium

Description

HKUDS OpenHarness prior to PR #159 remediation contains a session key derivation vulnerability that allows authenticated participants in shared chats or threads to hijack other users' sessions by exploiting a shared ohmo session key that lacks sender identity verification. Attackers can reuse another user's conversation state and replace or interrupt their active tasks by colliding into the same session boundary through the shared chat or thread scope.

SeverityMedium

CVSS6.3

Exploit probability—

ProductHkuds Openharness

PublishedApr 20, 2026

First seenApr 20, 2026

Weakness typeCWE-287Improper authentication

How to fix

Update

hkuds openharness0.1.7 or later

Patches

github.com/HKUDS/OpenHarness/commit/3186851c479ee714a9bb9aa6cd77017db7e589e2

Affected products

Product	Affected versions	Fixed in
hkuds openharness	v < 0.1.7	0.1.7

Check your version

Choose the product and enter the version you run to see whether it falls in the affected range.

In the Intelligence 360 plan

Attack Surface Management

See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.