CVE-2026-6729CWE-287

HKUDS OpenHarness Session Key Collision Privilege Escalation

Medium · published April 20, 2026

CVSS v4.0
5.3
EPSS
0%
Percentile
26.8
In the wild
Unconfirmed
What it is

HKUDS OpenHarness prior to PR #159 remediation contains a session key derivation vulnerability that allows authenticated participants in shared chats or threads to hijack other users' sessions by exploiting a shared ohmo session key that lacks sender identity verification. Attackers can reuse another user's conversation state and replace or interrupt their active tasks by colliding into the same session boundary through the shared chat or thread scope.

The record
Technical detail
CVSS v4.0
5.3 · MEDIUM
Vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N
EPSS
0.00345 · 26.8th percentile
Weakness
CWE-287 · Improper Authentication
Published
2026-04-20T22:01Z
EPSS history
Timeline
  • 20 APR 22:01Z
    HKUDS OpenHarness Session Key Collision Privilege Escalation
    cvelistv5