Vulnerability record/PUBLISHED/Published Oct 26, 2026 15:45:16 UTC

CVE-2026-116368

A vulnerability was determined in DeepSeek Harness up to 0.2.0-rc.2. This issue affects some unknown processing of the file packages/client/connection/src/browser-auth.ts of the component Browser Auth. This manipulation causes improper authorization. The attack can be initiated remotely. The vendor was contacted early about this disclosure but did not respond in any way.

Base score6.9/ 10

SeverityMediumCVSS 4.0

Exploitability / impact

CVSS metric breakdown

Vector-derived attributes

Base severityMedium

Attack vectorNetworkAV

Attack complexityLowAC

Attack requirementsNoneAT

Privileges requiredNonePR

User interactionNoneUI

Vulnerable system confidentialityLowVC

Vulnerable system integrityLowVI

Vulnerable system availabilityLowVA

Subsequent system confidentialityNoneSC

Subsequent system integrityNoneSI

Subsequent system availabilityNoneSA

Exploit maturityNot definedE

CVSS vector stringCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X

CVSS communicates standardized severity and impact characteristics. It does not establish whether a system is exploitable in your specific environment.

Record context

CVE Numbering AuthorityVulDB

Last updatedOct 26, 2026 15:45:16 UTC

PublishedOct 26, 2026 15:45:16 UTC

ReservedOct 26, 2026 08:01:48 UTC

Credits

JerryGW (VulDB User)
VulDB CNA Team