Vulnerability · Published Oct 26, 2026 · Assigned by VulDB

CVE-2026-116368DeepSeek Harness Browser Auth browser-auth.ts improper authorization

High 7.3

In plain English

A high-severity security flaw in Harness from DeepSeek. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.6% (higher than 48% of all known vulnerabilities).

Severity (CVSS 3.1)7.3High

Exploit odds (30 days)0.6%top 52.0% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

A vulnerability was determined in DeepSeek Harness up to 0.2.0-rc.2. This issue affects some unknown processing of the file packages/client/connection/src/browser-auth.ts of the component Browser Auth. This manipulation causes improper authorization. The attack can be initiated remotely. The vendor was contacted early about this disclosure but did not respond in any way.

Affected products (as reported)

Vendor	Product	Versions
DeepSeek	Harness	0.2.0-rc.00.2.0-rc.10.2.0-rc.2

Weakness: CWE-285, CWE-266 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:X/RL:X/RC:C

References

VDB-426332 | DeepSeek Harness Browser Auth browser-auth.ts improper authorization vdb-entry
VDB-426332 | CTI Indicators (IOB, IOC, TTP, IOA) signature, permissions-required
CVE-2026-116368 | CVE Analysis and Report third-party-advisory
Submit #1012891 | DeepSeek deepseek-harness（@deepseek-ai/dsh，DeepSeek Harness） 0.2.0-rc.2（verified in source and reproduced on the live instance） Authentication Bypass third-party-advisory