# CVE-2026-116368: DeepSeek Harness improper authorization in browser auth

Source: https://junglewise.ai/threats/cve-2026-116368-a-vulnerability-was-determined-in-deepseek-harness-up-to-0-2-0  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-10-26. Updated: 2026-10-26  
License: CC BY 4.0 with a link back

CVE-2026-116368 · Severity: high · CVSS 7.3 · Published 2026-10-26

DeepSeek Harness is a browser-based authentication component used in development tooling. A flaw in the browser authentication mechanism allows attackers to bypass authorization checks remotely, potentially granting unauthorized access to protected functionality or data without requiring valid credentials.

Technologies: [DeepSeek Harness](https://junglewise.ai/threats/technologies/deepseek-harness-1). Vendors: [DeepSeek](https://junglewise.ai/threats/vendors/deepseek).

## Quick answers

**Is CVE-2026-116368 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-116368 being exploited in the wild.

**How severe is CVE-2026-116368?** High severity, with a CVSS score of 7.3, published 26 October 2026.

**Which products and versions are affected?** DeepSeek Harness up to 0.2.0-rc.2.

**Is there a fix for CVE-2026-116368?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-116368 attacked?** It is attacked over the network.

**Am I affected by CVE-2026-116368?** Check whether you run DeepSeek Harness at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The vulnerability exists in the Browser Auth component (browser-auth.ts) of DeepSeek Harness and allows improper authorization through unknown processing logic. The issue is remotely exploitable and does not require authentication or user interaction, meaning an attacker can initiate the attack directly over the network.

## Affected products

- DeepSeek Harness up to 0.2.0-rc.2

## Timeline

- 2026-10-26: disclosed

## References

- [https://vuldb.com/cve/CVE-2026-116368](https://vuldb.com/cve/CVE-2026-116368)
- [https://vuldb.com/submit/1012891](https://vuldb.com/submit/1012891)

## Related threats

- [DeepSeek Harness auth bypass in web RPC control plane](https://junglewise.ai/threats/cve-2026-82033-deepseek-harness-prior-to-0-1-2-alpha-2-and-specifically-commit)
- [DeepSeek Harness sandbox issue in createContext](https://junglewise.ai/threats/cve-2026-116367-a-vulnerability-was-found-in-deepseek-harness-up-to-0-1-0-rc-5)