EUVD-2026-23983
GHSA-pvmf-7x77-8q82
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessJoin shared chat with victim
-
DeliveryCompute victim's session key using shared context
-
ExploitCraft message with hijacked session key
-
ExecutionSystem treats message as victim-sent
-
ImpactInterrupt or replace victim's active task
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A07:2025 - Authentication Failures
ASVS 5.0
V6 - Authentication Authentication mechanism validation
MITRE ATT&CK
2 techniques across 2 tactics: Defense Evasion, Initial Access The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Attacker must be an authenticated user with access to a shared chat or thread containing the target victim. The session key derivation must be scoped only to the shared chat/thread context without including per-user cryptographic material. The vulnerability does NOT require special server configuration or non-default settings - it is inherent to the session key derivation design. Exploitation is limited by the requirement that the attacker be already authenticated and a member of the same chat/thread as the victim, meaning it cannot be exploited against arbitrary users or in deployments using alternative authentication/session management schemes. |
| Impact | CVSS 5.3 with AV:N/AC:L/PR:L indicates network-accessible authenticated exploitation with low complexity, but impact is limited (VC:L/VI:L/VA:L) - scope is unchanged, meaning the session hijack affects only the confidentiality, integrity, and availability of the victim's session, not the system itself. EPSS and KEV status are not provided, so real-world exploitation probability cannot be assessed. However, the attack requires prior authentication (PR:L) and shared chat/thread membership, narrowing the practical attack surface compared to unauthenticated network RCE. The misalignment between CVSS 5.3 and the severity of session hijacking suggests this is a credible but lower-priority threat in deployments where chat participants are relatively trusted. Upstream fix exists (PR #159, commit 3186851c), reducing urgency for patching if deployments are updated. Active exploitation has not been confirmed - this appears to be researcher-disclosed rather than in-the-wild. |
| Exploit ScenarioDerived | An authenticated user Alice in a shared chat room with Bob computes the session key for Bob's session using only the shared chat context and the derivation algorithm, since no sender identity is verified. Alice then submits a crafted message that reuses Bob's session key, causing the system to treat the message as if Bob sent it, allowing Alice to interrupt Bob's active task or replace his conversation state with her own. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Apr 20, 2026
Session key derivation in HKUDS OpenHarness prior to PR #159 fails to verify sender identity in shared chat/thread scopes, allowing authenticated users to hijack other participants' sessions and disrupt their active tasks through collision attacks on the shared ohmo session key. The vulnerability requires prior authentication and network access but enables lateral privilege escalation within collaborative environments. No public exploit code has been identified, though the fix is available via upstream commit 3186851c.
RemediationAI
Update HKUDS OpenHarness to incorporate commit 3186851c479ee714a9bb9aa6cd77017db7e589e2 or any subsequent release that includes PR #159. Developers should modify the session key derivation to include sender identity (e.g., user ID, cryptographic identity) as a mandatory component, ensuring each participant derives unique session keys even within the same chat/thread scope. As an interim compensating control, restrict chat/thread membership to minimally necessary participants and monitor for anomalous session state changes (task interruptions, unexpected conversation context switches). However, compensating controls do not eliminate the vulnerability and should not replace patching. See https://github.com/HKUDS/OpenHarness/pull/159 and the VulnCheck advisory at https://www.vulncheck.com/advisories/hkuds-openharness-session-key-collision-privilege-escalation for implementation details.
Affected VersionsENISA
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
HKUDS OpenHarness uses a session key derivation mechanism (ohmo) that is scoped to shared chats or threads but lacks cryptographic binding to sender identity. This violates CWE-287 (Improper Authentication) by deriving session keys from shared context alone, allowing any authenticated participant to compute valid session keys for other users in the same chat/thread scope. The vulnerability exists in the session establishment protocol where the derived session key does not include a unique per-user component, enabling session fixation and state collision attacks. Attackers exploit this by reusing another user's conversation state through the shared boundary, effectively hijacking the session and replacing or interrupting the victim's active tasks.
Know when Openharness gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N
Primary rating from Vendor (vulncheck) · only source for this CVE.
CVSS VectorVendor: vulncheck
DescriptionCVE.org
HKUDS OpenHarness prior to PR #159 remediation contains a session key derivation vulnerability that allows authenticated participants in shared chats or threads to hijack other users' sessions by exploiting a shared ohmo session key that lacks sender identity verification. Attackers can reuse another user's conversation state and replace or interrupt their active tasks by colliding into the same session boundary through the shared chat or thread scope.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
More in Openharness
View allRemote code execution in HKUDS OpenHarness allows authenticated remote attackers to execute arbitrary operating system c
Remote command injection in OpenHarness gateway handler allows authenticated remote chat users to execute administrative
Remote attackers can install and activate arbitrary plugins in HKUDS OpenHarness through exposed plugin management comma
Remote unauthenticated attackers can bypass path restrictions in OpenHarness (pre-commit bd4df81) to read arbitrary sens
Improper access control in OpenHarness (prior to commit 166fcfe) allows local authenticated attackers with influence ove
Unauthorized remote access in HKUDS OpenHarness (all versions prior to the PR #147 fix, released as v0.1.7) stems from a
Server-Side Request Forgery in OpenHarness AI agent framework (pre-commit bd4df81) permits remote unauthenticated attack
Cross-session information disclosure in HKUDS OpenHarness ohmo gateway allows admitted remote senders to invoke /resume
Path traversal in OpenHarness allows authenticated gateway users with chat access to read arbitrary files on the server
Remote prompt injection in OpenHarness allows low-privileged messaging channel participants to persistently corrupt AI a
Exploit-DB