The vulnerability arises from the way the Browser Auth component processes the file packages/client/connection/src/browser-auth.ts. An attacker can manipulate this processing to bypass authorization checks, enabling remote execution of privileged actions. This flaw can result in unauthorized access to protected resources, potentially exposing sensitive data or allowing the attacker to perform actions on behalf of legitimate users. The vulnerability is classified with a CVSS score of 6.9, indicating a moderate to high risk level.

The issue affects DeepSeek Harness versions up to 0.2.0‑rc.2. The affected component is Browser Auth, part of the Harness application. No other vendors or products are listed. Since the exact version roll‑up beyond 0.2.0‑rc.2 is unknown, users deploying any earlier or equivalent build should verify compatibility.

The flaw can be triggered remotely, implying that an attacker can gain elevated privileges from outside the network without needing prior authentication. While the EPSS score is not available, the CVSS rating suggests significant potential impact. The vulnerability is not listed in CISA’s KEV catalog, but the lack of a vendor response and absence of an immediate fix increase the risk that attackers may attempt exploitation once a workable payload is discovered. The likelihood of exploitation depends on the visibility of the vulnerable endpoint and how widely the affected version is deployed.