PT-2026-33856 · Hkuds · Openharness

Published 2026-04-20 · Updated 2026-04-21 · CVE-2026-6729

Positive Technologies (AI Summary)

CVSS v3.1

7.6

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:L

Name of the Vulnerable Software and Affected Versions HKUDS OpenHarness versions prior to PR #159

Description A session key derivation issue allows authenticated participants in shared chats or threads to hijack other users' sessions. This occurs because the shared ohmo session key lacks sender identity verification, enabling attackers to reuse another user's conversation state and replace or interrupt active tasks by colliding into the same session boundary through the shared chat or thread scope.

Recommendations Update to the version containing the PR #159 remediation.

Exploit

Fix

Improper Authentication

Weakness Enumeration

CWE-287

Related Identifiers

CVE-2026-6729

Affected Products

Openharness

References · 5

• 🔥 https://github.com/HKUDS/OpenHarness/pull/159 · Exploit
• https://github.com/HKUDS/OpenHarness/commit/3186851c479ee714a9bb9aa6cd77017db7e589e2 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2026-6729 · Security Note
• https://twitter.com/CVEnew/status/2046571889796231527 · Twitter Post
• https://vulncheck.com/advisories/hkuds-openharness-session-key-collision-privilege-escalation · Note