CVE-2026-6729
Last modified
CVE-2026-6729 is a high-severity vulnerability rated 7.6/10 on the CVSS scale. HKUDS OpenHarness prior to PR #159 remediation contains a session key derivation vulnerability that allows authenticated participants in shared chats or threads to hijack other users' sessions by exploiting a shared ohmo session key that lacks sender identity verification. Attackers can reuse another user's conversation state and replace or interrupt their active tasks by colliding into the same session boundary through the shared chat or thread scope.. EPSS estimates a 0.20% chance of exploitation in the next 30 days.
Description
HKUDS OpenHarness prior to PR #159 remediation contains a session key derivation vulnerability that allows authenticated participants in shared chats or threads to hijack other users' sessions by exploiting a shared ohmo session key that lacks sender identity verification. Attackers can reuse another user's conversation state and replace or interrupt their active tasks by colliding into the same session boundary through the shared chat or thread scope.
Metrics
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:L
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Weakness Enumeration
Affected Software
| Vendor | Product | Versions |
|---|---|---|
| Hkuds | Openharness | < 0.1.7 |
References
- https://github.com/HKUDS/OpenHarness/pull/159Exploit, Issue Tracking
- https://github.com/HKUDS/OpenHarness/pull/159Exploit, Issue Tracking
Timeline
- Published
- Last Modified
- Status
- Analyzed
Frequently Asked Questions
What is CVE-2026-6729?
How severe is CVE-2026-6729?
How do I fix CVE-2026-6729?
How Strix Helps
- How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2026
- CVE-2026-67284Joomla Extension - tabaoca.org - Improper ACL implementation…5.3
- CVE-2026-67285Joomla Extension - joomshaper.com - Unauthenticated arbitrar…9.2
- CVE-2026-67286Joomla Extension - joomshaper.com - Unauthenticated arbitrar…6.3
- CVE-2026-67287Joomla Extension - joomshaper.com - Unauthenticated comment …6.3
- CVE-2026-67288FreeRDP before 3.29.0 contains a null pointer dereference vu…8.7
- CVE-2026-67289FreeRDP before 3.29.0 (affected versions <= 3.28.0) does not…9.8
- CVE-2026-67290FreeRDP before 3.29.0 contains a heap out-of-bounds read vul…8.7
- CVE-2026-67291FreeRDP before 3.29.0 (affected versions <= 3.28.0) contains…8.7
- CVE-2026-67292FreeRDP before 3.29.0 contains a buffer over-disclosure vuln…9.3
- CVE-2026-67293FreeRDP before 3.29.0 (affected versions <= 3.28.0) contains…9.3
- CVE-2026-67294FreeRDP before 3.29.0 improperly validates the Extended Key …9.3
- CVE-2026-67295FreeRDP before 3.29.0 fails to properly validate server-supp…6.3
Are you affected by CVE-2026-6729?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST