HKUDS OpenHarness prior to PR #159 remediation contains a session key derivation vulnerability that allows authenticated participants in shared chats or threads to hijack other users' sessions by exploiting a shared ohmo session key that lacks sender identity verification. Attackers can reuse another user's conversation state and replace or interrupt their active tasks by colliding into the same session boundary through the shared chat or thread scope.
References
| Link | Resource |
|---|---|
| https://github.com/HKUDS/OpenHarness/commit/3186851c479ee714a9bb9aa6cd77017db7e589e2 | Patch |
| https://github.com/HKUDS/OpenHarness/pull/159 | Exploit Issue Tracking |
| https://www.vulncheck.com/advisories/hkuds-openharness-session-key-collision-privilege-escalation | Third Party Advisory |
| https://github.com/HKUDS/OpenHarness/pull/159 | Exploit Issue Tracking |
Configurations
History
24 Apr 2026, 19:14
| Type | Values Removed | Values Added |
|---|---|---|
| References | () https://github.com/HKUDS/OpenHarness/commit/3186851c479ee714a9bb9aa6cd77017db7e589e2 - Patch | |
| References | () https://github.com/HKUDS/OpenHarness/pull/159 - Exploit, Issue Tracking | |
| References | () https://www.vulncheck.com/advisories/hkuds-openharness-session-key-collision-privilege-escalation - Third Party Advisory | |
| First Time |
Hkuds openharness
Hkuds |
|
| CPE | cpe:2.3:a:hkuds:openharness:*:*:*:*:*:*:*:* |
21 Apr 2026, 18:16
| Type | Values Removed | Values Added |
|---|---|---|
| References | () https://github.com/HKUDS/OpenHarness/pull/159 - |
20 Apr 2026, 22:16
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2026-04-20 22:16
Updated : 2026-04-24 19:14
NVD link : CVE-2026-6729
Mitre link : CVE-2026-6729
CVE.ORG link : CVE-2026-6729
JSON object : View
Products Affected
hkuds
- openharness
CWE
CWE-287
Improper Authentication