DeepSeek Harness: Improper authorization in Browser Auth component (CVE-2026-116368)
DeepSeek Harness up to 0.2.0-rc.2 contains a vulnerability in the Browser Auth component (packages/client/connection/src/browser-auth.ts) that leads to improper authorization and can be initiated remotely.
CVE search metadata
CVE search record: CVE-2026-116368. Severity: high. CVSS: 7.3. KEV: no. Product: Harness (up to 0.2.0-rc.2). Brief: DeepSeek Harness: Improper authorization in Browser Auth component (CVE-2026-116368). Brief link: https://feed.craftedsignal.io/briefs/2026-10-deepseek-harness-auth/
Triage facts
Revision 1- Applicability
- Harness (up to 0.2.0-rc.2)
- Evidence
- Unknown
- Severity
- High
- Sources
- 1 public source
- Freshness
- Revision 1Oct 26, 17:44 UTC
- Vulnerabilities
- 1 CVE
- Source quality
- A2Roughly even chance
A vulnerability, identified as CVE-2026-116368, exists in DeepSeek Harness up to 0.2.0-rc.2. The issue affects the 'packages/client/connection/src/browser-auth.ts' file within the Browser Auth component. This manipulation results in improper authorization and can be exploited remotely. The vendor was contacted regarding this disclosure but did not respond.