HKUDS OpenHarness versions prior to the PR #159 remediation contain a session key derivation vulnerability classified as improper authentication (CWE-287). Authenticated users in shared chat or thread environments can exploit a shared ohmo session key that does not verify sender identity, allowing them to hijack other users' sessions. This enables attackers to reuse conversation states and replace or interrupt active tasks by colliding within the same session boundary. The vulnerability has a CVSS 4.0 base score of 5.3, indicating medium severity. No official patch or remediation level has been provided yet, and no known exploits are reported in the wild.

An attacker who is an authenticated participant in a shared chat or thread can hijack other users' sessions by exploiting the shared session key lacking sender identity verification. This can lead to unauthorized reuse of conversation states and interruption or replacement of active user tasks within the affected session. The impact is limited to authenticated users within shared communication scopes and does not involve privilege escalation or remote unauthenticated access.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official patch or remediation level is provided, users should monitor the vendor's communications for updates regarding PR #159 or other fixes addressing this vulnerability. Until a fix is available, limit the exposure of shared chat or thread sessions to trusted participants only.