CVE-2026-6729

OVERVIEW: CVE-2026-6729 is a session key derivation vulnerability in HKUDS OpenHarness prior to PR #159 that allows authenticated users to hijack other participants' sessions within shared chats or threads. The flaw stems from an ohmo session key implementation that lacks sender identity verification, enabling attackers to reuse another user's conversation state and manipulate their active tasks through session boundary collisions. SEVERITY: The vulnerability carries a CVSS 3.1 score of 6.3 (MEDIUM) with a network-based attack vector that requires low complexity and valid user authentication. The impact is limited but meaningful, affecting confidentiality, integrity, and availability equally. The attack requires no user interaction and operates within the application's normal scope, making it a credential-dependent threat that could disrupt collaborative workflows and expose sensitive task information. EXPLOITATION STATUS: There is no evidence of active exploitation in the wild. The vulnerability does not appear on the CISA Known Exploited Vulnerabilities catalog, and the EPSS score of 0.00034 indicates minimal probability of exploitation compared to other disclosed CVEs. Community attention remains low, with no publicly available exploit code documented.