DeepSeek Harness EUVD-2026-109920

The target must be running an affected pre-release build of DeepSeek Harness (0.2.0-rc.0, 0.2.0-rc.1, or 0.2.0-rc.2) with the Browser Auth component (packages/client/connection/src/browser-auth.ts) reachable over the network. Per the CVSS vector (PR:N/UI:N), no authentication or user interaction is required and the attack is remote; the description states only that unknown processing in browser-auth.ts causes improper authorization and the trigger itself is not described in the available sources. Limiting factors: exploitation is confined to these specific release-candidate versions, the resulting impact is Low across confidentiality/integrity/availability with no scope/subsequent-system effect, and no fixed version is listed by the unresponsive vendor.

Signals point to a moderate, not emergency-level, priority. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) describes a remotely reachable, low-complexity, unauthenticated flaw, but the vulnerable-system impacts are all Low (VC:L/VI:L/VA:L) and there is no subsequent-system impact (SC:N/SI:N/SA:N), yielding a base score of 6.9 (medium). The vuln.today decision label is 'this_month', consistent with a real-but-not-urgent issue rather than act_now/emergency. No EPSS score, no CISA KEV listing, and no public exploit were provided in the input, so there is no evidence of active exploitation or weaponization. The data is single-sourced (VulDB/EUVD) with no vendor advisory - the vendor was contacted and did not respond - which weakens corroboration of the technical details. Net: a genuine unauthenticated authorization-bypass worth scheduled remediation, but the Low impact metrics and absence of exploitation signals argue against treating it as a drop-everything issue. Missing signals (EPSS, independent confirmation, vendor advisory) should be noted rather than assumed benign.

A remote, unauthenticated attacker sends crafted requests to a deployment of DeepSeek Harness (<=0.2.0-rc.2) exercising the Browser Auth logic in browser-auth.ts, and the improper authorization check lets them perform actions or reach resources that should require proper authorization. Because the CVSS vector is AV:N/AC:L/PR:N/UI:N, no credentials or user interaction are needed, but the impact is limited (Low confidentiality/integrity/availability). No public exploit was identified at time of analysis, and the exact trigger is not described in the available sources.