This vulnerability in HKUDS OpenHarness affects versions prior to the PR #159 remediation. It is caused by improper authentication (CWE-287) related to session key derivation. Authenticated users in shared chat or thread environments can exploit the shared ohmo session key, which does not verify sender identity, to hijack other users' sessions. This allows attackers to reuse conversation states and replace or interrupt active tasks by colliding into the same session boundary. The CVSS 4.0 base score is 5.3, indicating medium severity, with network attack vector, low attack complexity, and low impacts on confidentiality, integrity, and availability.

The vulnerability allows authenticated participants in shared chats or threads to hijack other users' sessions by exploiting the shared session key. This can lead to unauthorized reuse of conversation states and interruption or replacement of active user tasks within the affected session. There is no indication of remote unauthenticated exploitation or widespread active exploitation in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. The vulnerability is noted to exist prior to PR #159 remediation, implying a fix may be available in that update. Until official confirmation is obtained, users should apply PR #159 or later updates once available to remediate this issue. No other specific mitigations are provided.